mirror of
https://github.com/k3s-io/kubernetes.git
synced 2025-07-25 20:53:33 +00:00
remove audit.k8s.io/v1[alpha|beta]1 versions
This commit is contained in:
carlory
parent
34a6a7ca11
commit
fcc282f9f2
@ -336,30 +336,6 @@ API rule violation: list_type_missing,k8s.io/apiserver/pkg/apis/audit/v1,PolicyR
|
||||
API rule violation: list_type_missing,k8s.io/apiserver/pkg/apis/audit/v1,PolicyRule,UserGroups
|
||||
API rule violation: list_type_missing,k8s.io/apiserver/pkg/apis/audit/v1,PolicyRule,Users
|
||||
API rule violation: list_type_missing,k8s.io/apiserver/pkg/apis/audit/v1,PolicyRule,Verbs
|
||||
API rule violation: list_type_missing,k8s.io/apiserver/pkg/apis/audit/v1alpha1,Event,SourceIPs
|
||||
API rule violation: list_type_missing,k8s.io/apiserver/pkg/apis/audit/v1alpha1,GroupResources,ResourceNames
|
||||
API rule violation: list_type_missing,k8s.io/apiserver/pkg/apis/audit/v1alpha1,GroupResources,Resources
|
||||
API rule violation: list_type_missing,k8s.io/apiserver/pkg/apis/audit/v1alpha1,Policy,OmitStages
|
||||
API rule violation: list_type_missing,k8s.io/apiserver/pkg/apis/audit/v1alpha1,Policy,Rules
|
||||
API rule violation: list_type_missing,k8s.io/apiserver/pkg/apis/audit/v1alpha1,PolicyRule,Namespaces
|
||||
API rule violation: list_type_missing,k8s.io/apiserver/pkg/apis/audit/v1alpha1,PolicyRule,NonResourceURLs
|
||||
API rule violation: list_type_missing,k8s.io/apiserver/pkg/apis/audit/v1alpha1,PolicyRule,OmitStages
|
||||
API rule violation: list_type_missing,k8s.io/apiserver/pkg/apis/audit/v1alpha1,PolicyRule,Resources
|
||||
API rule violation: list_type_missing,k8s.io/apiserver/pkg/apis/audit/v1alpha1,PolicyRule,UserGroups
|
||||
API rule violation: list_type_missing,k8s.io/apiserver/pkg/apis/audit/v1alpha1,PolicyRule,Users
|
||||
API rule violation: list_type_missing,k8s.io/apiserver/pkg/apis/audit/v1alpha1,PolicyRule,Verbs
|
||||
API rule violation: list_type_missing,k8s.io/apiserver/pkg/apis/audit/v1beta1,Event,SourceIPs
|
||||
API rule violation: list_type_missing,k8s.io/apiserver/pkg/apis/audit/v1beta1,GroupResources,ResourceNames
|
||||
API rule violation: list_type_missing,k8s.io/apiserver/pkg/apis/audit/v1beta1,GroupResources,Resources
|
||||
API rule violation: list_type_missing,k8s.io/apiserver/pkg/apis/audit/v1beta1,Policy,OmitStages
|
||||
API rule violation: list_type_missing,k8s.io/apiserver/pkg/apis/audit/v1beta1,Policy,Rules
|
||||
API rule violation: list_type_missing,k8s.io/apiserver/pkg/apis/audit/v1beta1,PolicyRule,Namespaces
|
||||
API rule violation: list_type_missing,k8s.io/apiserver/pkg/apis/audit/v1beta1,PolicyRule,NonResourceURLs
|
||||
API rule violation: list_type_missing,k8s.io/apiserver/pkg/apis/audit/v1beta1,PolicyRule,OmitStages
|
||||
API rule violation: list_type_missing,k8s.io/apiserver/pkg/apis/audit/v1beta1,PolicyRule,Resources
|
||||
API rule violation: list_type_missing,k8s.io/apiserver/pkg/apis/audit/v1beta1,PolicyRule,UserGroups
|
||||
API rule violation: list_type_missing,k8s.io/apiserver/pkg/apis/audit/v1beta1,PolicyRule,Users
|
||||
API rule violation: list_type_missing,k8s.io/apiserver/pkg/apis/audit/v1beta1,PolicyRule,Verbs
|
||||
API rule violation: list_type_missing,k8s.io/controller-manager/config/v1alpha1,GenericControllerManagerConfiguration,Controllers
|
||||
API rule violation: list_type_missing,k8s.io/controller-manager/config/v1alpha1,LeaderMigrationConfiguration,ControllerLeaders
|
||||
API rule violation: list_type_missing,k8s.io/kube-controller-manager/config/v1alpha1,GarbageCollectorControllerConfiguration,GCIgnoredResources
|
||||
|
||||
@ -70,7 +70,7 @@ func TestAddFlags(t *testing.T) {
|
||||
"--audit-log-truncate-enabled=true",
|
||||
"--audit-log-truncate-max-batch-size=45",
|
||||
"--audit-log-truncate-max-event-size=44",
|
||||
"--audit-log-version=audit.k8s.io/v1alpha1",
|
||||
"--audit-log-version=audit.k8s.io/v1",
|
||||
"--audit-policy-file=/policy",
|
||||
"--audit-webhook-config-file=/webhook-config",
|
||||
"--audit-webhook-mode=blocking",
|
||||
@ -84,7 +84,7 @@ func TestAddFlags(t *testing.T) {
|
||||
"--audit-webhook-truncate-max-batch-size=43",
|
||||
"--audit-webhook-truncate-max-event-size=42",
|
||||
"--audit-webhook-initial-backoff=2s",
|
||||
"--audit-webhook-version=audit.k8s.io/v1alpha1",
|
||||
"--audit-webhook-version=audit.k8s.io/v1",
|
||||
"--authentication-token-webhook-cache-ttl=3m",
|
||||
"--authentication-token-webhook-config-file=/token-webhook-config",
|
||||
"--authorization-mode=AlwaysDeny,RBAC",
|
||||
@ -228,7 +228,7 @@ func TestAddFlags(t *testing.T) {
|
||||
MaxEventSize: 44,
|
||||
},
|
||||
},
|
||||
GroupVersionString: "audit.k8s.io/v1alpha1",
|
||||
GroupVersionString: "audit.k8s.io/v1",
|
||||
},
|
||||
WebhookOptions: apiserveroptions.AuditWebhookOptions{
|
||||
ConfigFile: "/webhook-config",
|
||||
@ -252,7 +252,7 @@ func TestAddFlags(t *testing.T) {
|
||||
},
|
||||
},
|
||||
InitialBackoff: 2 * time.Second,
|
||||
GroupVersionString: "audit.k8s.io/v1alpha1",
|
||||
GroupVersionString: "audit.k8s.io/v1",
|
||||
},
|
||||
PolicyFile: "/policy",
|
||||
},
|
||||
|
||||
1190
pkg/generated/openapi/zz_generated.openapi.go
generated
1190
pkg/generated/openapi/zz_generated.openapi.go
generated
File diff suppressed because it is too large
Load Diff
@ -23,15 +23,11 @@ import (
|
||||
utilruntime "k8s.io/apimachinery/pkg/util/runtime"
|
||||
"k8s.io/apiserver/pkg/apis/audit"
|
||||
"k8s.io/apiserver/pkg/apis/audit/v1"
|
||||
"k8s.io/apiserver/pkg/apis/audit/v1alpha1"
|
||||
"k8s.io/apiserver/pkg/apis/audit/v1beta1"
|
||||
)
|
||||
|
||||
// Install registers the API group and adds types to a scheme
|
||||
func Install(scheme *runtime.Scheme) {
|
||||
utilruntime.Must(audit.AddToScheme(scheme))
|
||||
utilruntime.Must(v1.AddToScheme(scheme))
|
||||
utilruntime.Must(v1beta1.AddToScheme(scheme))
|
||||
utilruntime.Must(v1alpha1.AddToScheme(scheme))
|
||||
utilruntime.Must(scheme.SetVersionPriority(v1.SchemeGroupVersion, v1beta1.SchemeGroupVersion, v1alpha1.SchemeGroupVersion))
|
||||
utilruntime.Must(scheme.SetVersionPriority(v1.SchemeGroupVersion))
|
||||
}
|
||||
|
||||
@ -1,78 +0,0 @@
|
||||
/*
|
||||
Copyright 2017 The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package v1alpha1
|
||||
|
||||
import (
|
||||
"strings"
|
||||
|
||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
"k8s.io/apimachinery/pkg/conversion"
|
||||
"k8s.io/apiserver/pkg/apis/audit"
|
||||
)
|
||||
|
||||
func Convert_audit_ObjectReference_To_v1alpha1_ObjectReference(in *audit.ObjectReference, out *ObjectReference, s conversion.Scope) error {
|
||||
// Begin by copying all fields
|
||||
if err := autoConvert_audit_ObjectReference_To_v1alpha1_ObjectReference(in, out, s); err != nil {
|
||||
return err
|
||||
}
|
||||
// empty string means the core api group
|
||||
if in.APIGroup == "" {
|
||||
out.APIVersion = in.APIVersion
|
||||
} else {
|
||||
out.APIVersion = in.APIGroup + "/" + in.APIVersion
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func Convert_v1alpha1_ObjectReference_To_audit_ObjectReference(in *ObjectReference, out *audit.ObjectReference, s conversion.Scope) error {
|
||||
// Begin by copying all fields
|
||||
if err := autoConvert_v1alpha1_ObjectReference_To_audit_ObjectReference(in, out, s); err != nil {
|
||||
return err
|
||||
}
|
||||
i := strings.LastIndex(in.APIVersion, "/")
|
||||
if i == -1 {
|
||||
// In fact it should always contain a "/"
|
||||
out.APIVersion = in.APIVersion
|
||||
} else {
|
||||
out.APIGroup = in.APIVersion[:i]
|
||||
out.APIVersion = in.APIVersion[i+1:]
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func Convert_v1alpha1_Event_To_audit_Event(in *Event, out *audit.Event, s conversion.Scope) error {
|
||||
if err := autoConvert_v1alpha1_Event_To_audit_Event(in, out, s); err != nil {
|
||||
return err
|
||||
}
|
||||
if out.StageTimestamp.IsZero() {
|
||||
out.StageTimestamp = metav1.NewMicroTime(in.CreationTimestamp.Time)
|
||||
}
|
||||
if out.RequestReceivedTimestamp.IsZero() {
|
||||
out.RequestReceivedTimestamp = metav1.NewMicroTime(in.Timestamp.Time)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func Convert_audit_Event_To_v1alpha1_Event(in *audit.Event, out *Event, s conversion.Scope) error {
|
||||
if err := autoConvert_audit_Event_To_v1alpha1_Event(in, out, s); err != nil {
|
||||
return err
|
||||
}
|
||||
out.CreationTimestamp = metav1.NewTime(in.StageTimestamp.Time)
|
||||
out.Timestamp = metav1.NewTime(in.RequestReceivedTimestamp.Time)
|
||||
return nil
|
||||
|
||||
}
|
||||
@ -1,201 +0,0 @@
|
||||
/*
|
||||
Copyright 2017 The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package v1alpha1
|
||||
|
||||
import (
|
||||
"reflect"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
"k8s.io/apimachinery/pkg/runtime"
|
||||
"k8s.io/apimachinery/pkg/runtime/schema"
|
||||
auditinternal "k8s.io/apiserver/pkg/apis/audit"
|
||||
)
|
||||
|
||||
var scheme = runtime.NewScheme()
|
||||
|
||||
func init() {
|
||||
addKnownTypes(scheme)
|
||||
internalGV := schema.GroupVersion{Group: auditinternal.GroupName, Version: runtime.APIVersionInternal}
|
||||
scheme.AddKnownTypes(internalGV,
|
||||
&auditinternal.Event{},
|
||||
)
|
||||
RegisterConversions(scheme)
|
||||
}
|
||||
|
||||
func TestConversionObjectReference(t *testing.T) {
|
||||
testcases := []struct {
|
||||
desc string
|
||||
old *ObjectReference
|
||||
expected *auditinternal.ObjectReference
|
||||
}{
|
||||
{
|
||||
"core group",
|
||||
&ObjectReference{
|
||||
APIVersion: "/v1",
|
||||
},
|
||||
&auditinternal.ObjectReference{
|
||||
APIVersion: "v1",
|
||||
APIGroup: "",
|
||||
},
|
||||
},
|
||||
{
|
||||
"other groups",
|
||||
&ObjectReference{
|
||||
APIVersion: "rbac.authorization.k8s.io/v1beta1",
|
||||
},
|
||||
&auditinternal.ObjectReference{
|
||||
APIVersion: "v1beta1",
|
||||
APIGroup: "rbac.authorization.k8s.io",
|
||||
},
|
||||
},
|
||||
{
|
||||
"all empty",
|
||||
&ObjectReference{},
|
||||
&auditinternal.ObjectReference{},
|
||||
},
|
||||
{
|
||||
"invalid apiversion should not cause painc",
|
||||
&ObjectReference{
|
||||
APIVersion: "invalid version without slash",
|
||||
},
|
||||
&auditinternal.ObjectReference{
|
||||
APIVersion: "invalid version without slash",
|
||||
APIGroup: "",
|
||||
},
|
||||
},
|
||||
}
|
||||
for _, tc := range testcases {
|
||||
t.Run(tc.desc, func(t *testing.T) {
|
||||
internal := &auditinternal.ObjectReference{}
|
||||
if err := scheme.Convert(tc.old, internal, nil); err != nil {
|
||||
t.Errorf("unexpected error: %v", err)
|
||||
}
|
||||
if !reflect.DeepEqual(internal, tc.expected) {
|
||||
t.Errorf("expected\n\t%#v, got \n\t%#v", tc.expected, internal)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestConversionEventToInternal(t *testing.T) {
|
||||
time1 := time.Now()
|
||||
time2 := time.Now()
|
||||
testcases := []struct {
|
||||
desc string
|
||||
old *Event
|
||||
expected *auditinternal.Event
|
||||
}{
|
||||
{
|
||||
"StageTimestamp is empty",
|
||||
&Event{
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
CreationTimestamp: metav1.NewTime(time1),
|
||||
},
|
||||
},
|
||||
&auditinternal.Event{
|
||||
StageTimestamp: metav1.NewMicroTime(time1),
|
||||
},
|
||||
},
|
||||
{
|
||||
"StageTimestamp is not empty",
|
||||
&Event{
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
CreationTimestamp: metav1.NewTime(time1),
|
||||
},
|
||||
StageTimestamp: metav1.NewMicroTime(time2),
|
||||
},
|
||||
&auditinternal.Event{
|
||||
StageTimestamp: metav1.NewMicroTime(time2),
|
||||
},
|
||||
},
|
||||
{
|
||||
"RequestReceivedTimestamp is empty",
|
||||
&Event{
|
||||
Timestamp: metav1.NewTime(time1),
|
||||
},
|
||||
&auditinternal.Event{
|
||||
RequestReceivedTimestamp: metav1.NewMicroTime(time1),
|
||||
},
|
||||
},
|
||||
{
|
||||
"RequestReceivedTimestamp is not empty",
|
||||
&Event{
|
||||
Timestamp: metav1.NewTime(time1),
|
||||
RequestReceivedTimestamp: metav1.NewMicroTime(time2),
|
||||
},
|
||||
&auditinternal.Event{
|
||||
RequestReceivedTimestamp: metav1.NewMicroTime(time2),
|
||||
},
|
||||
},
|
||||
}
|
||||
for _, tc := range testcases {
|
||||
t.Run(tc.desc, func(t *testing.T) {
|
||||
internal := &auditinternal.Event{}
|
||||
if err := scheme.Convert(tc.old, internal, nil); err != nil {
|
||||
t.Errorf("unexpected error: %v", err)
|
||||
}
|
||||
if !reflect.DeepEqual(internal, tc.expected) {
|
||||
t.Errorf("expected\n\t%#v, got \n\t%#v", tc.expected, internal)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestConversionInternalToEvent(t *testing.T) {
|
||||
now := time.Now()
|
||||
testcases := []struct {
|
||||
desc string
|
||||
old *auditinternal.Event
|
||||
expected *Event
|
||||
}{
|
||||
{
|
||||
"convert stageTimestamp",
|
||||
&auditinternal.Event{
|
||||
StageTimestamp: metav1.NewMicroTime(now),
|
||||
},
|
||||
&Event{
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
CreationTimestamp: metav1.NewTime(now),
|
||||
},
|
||||
StageTimestamp: metav1.NewMicroTime(now),
|
||||
},
|
||||
},
|
||||
{
|
||||
"convert RequestReceivedTimestamp",
|
||||
&auditinternal.Event{
|
||||
RequestReceivedTimestamp: metav1.NewMicroTime(now),
|
||||
},
|
||||
&Event{
|
||||
Timestamp: metav1.NewTime(now),
|
||||
RequestReceivedTimestamp: metav1.NewMicroTime(now),
|
||||
},
|
||||
},
|
||||
}
|
||||
for _, tc := range testcases {
|
||||
t.Run(tc.desc, func(t *testing.T) {
|
||||
event := &Event{}
|
||||
if err := scheme.Convert(tc.old, event, nil); err != nil {
|
||||
t.Errorf("unexpected error: %v", err)
|
||||
}
|
||||
if !reflect.DeepEqual(event, tc.expected) {
|
||||
t.Errorf("expected\n\t%#v, got \n\t%#v", tc.expected, event)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
@ -1,26 +0,0 @@
|
||||
/*
|
||||
Copyright 2017 The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
// +k8s:deepcopy-gen=package
|
||||
// +k8s:protobuf-gen=package
|
||||
// +k8s:conversion-gen=k8s.io/apiserver/pkg/apis/audit
|
||||
// +k8s:openapi-gen=true
|
||||
// +k8s:prerelease-lifecycle-gen=true
|
||||
// +k8s:defaulter-gen=TypeMeta
|
||||
|
||||
// +groupName=audit.k8s.io
|
||||
|
||||
package v1alpha1 // import "k8s.io/apiserver/pkg/apis/audit/v1alpha1"
|
||||
File diff suppressed because it is too large
Load Diff
@ -1,274 +0,0 @@
|
||||
/*
|
||||
Copyright The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
|
||||
// This file was autogenerated by go-to-protobuf. Do not edit it manually!
|
||||
|
||||
syntax = "proto2";
|
||||
|
||||
package k8s.io.apiserver.pkg.apis.audit.v1alpha1;
|
||||
|
||||
import "k8s.io/api/authentication/v1/generated.proto";
|
||||
import "k8s.io/apimachinery/pkg/apis/meta/v1/generated.proto";
|
||||
import "k8s.io/apimachinery/pkg/runtime/generated.proto";
|
||||
import "k8s.io/apimachinery/pkg/runtime/schema/generated.proto";
|
||||
|
||||
// Package-wide variables from generator "generated".
|
||||
option go_package = "k8s.io/apiserver/pkg/apis/audit/v1alpha1";
|
||||
|
||||
// DEPRECATED - This group version of Event is deprecated by audit.k8s.io/v1/Event. See the release notes for
|
||||
// more information.
|
||||
// Event captures all the information that can be included in an API audit log.
|
||||
message Event {
|
||||
// ObjectMeta is included for interoperability with API infrastructure.
|
||||
// +optional
|
||||
optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
|
||||
|
||||
// AuditLevel at which event was generated
|
||||
optional string level = 2;
|
||||
|
||||
// Time the request reached the apiserver.
|
||||
optional k8s.io.apimachinery.pkg.apis.meta.v1.Time timestamp = 3;
|
||||
|
||||
// Unique audit ID, generated for each request.
|
||||
optional string auditID = 4;
|
||||
|
||||
// Stage of the request handling when this event instance was generated.
|
||||
optional string stage = 5;
|
||||
|
||||
// RequestURI is the request URI as sent by the client to a server.
|
||||
optional string requestURI = 6;
|
||||
|
||||
// Verb is the kubernetes verb associated with the request.
|
||||
// For non-resource requests, this is the lower-cased HTTP method.
|
||||
optional string verb = 7;
|
||||
|
||||
// Authenticated user information.
|
||||
optional k8s.io.api.authentication.v1.UserInfo user = 8;
|
||||
|
||||
// Impersonated user information.
|
||||
// +optional
|
||||
optional k8s.io.api.authentication.v1.UserInfo impersonatedUser = 9;
|
||||
|
||||
// Source IPs, from where the request originated and intermediate proxies.
|
||||
// +optional
|
||||
repeated string sourceIPs = 10;
|
||||
|
||||
// UserAgent records the user agent string reported by the client.
|
||||
// Note that the UserAgent is provided by the client, and must not be trusted.
|
||||
// +optional
|
||||
optional string userAgent = 18;
|
||||
|
||||
// Object reference this request is targeted at.
|
||||
// Does not apply for List-type requests, or non-resource requests.
|
||||
// +optional
|
||||
optional ObjectReference objectRef = 11;
|
||||
|
||||
// The response status, populated even when the ResponseObject is not a Status type.
|
||||
// For successful responses, this will only include the Code and StatusSuccess.
|
||||
// For non-status type error responses, this will be auto-populated with the error Message.
|
||||
// +optional
|
||||
optional k8s.io.apimachinery.pkg.apis.meta.v1.Status responseStatus = 12;
|
||||
|
||||
// API object from the request, in JSON format. The RequestObject is recorded as-is in the request
|
||||
// (possibly re-encoded as JSON), prior to version conversion, defaulting, admission or
|
||||
// merging. It is an external versioned object type, and may not be a valid object on its own.
|
||||
// Omitted for non-resource requests. Only logged at Request Level and higher.
|
||||
// +optional
|
||||
optional k8s.io.apimachinery.pkg.runtime.Unknown requestObject = 13;
|
||||
|
||||
// API object returned in the response, in JSON. The ResponseObject is recorded after conversion
|
||||
// to the external type, and serialized as JSON. Omitted for non-resource requests. Only logged
|
||||
// at Response Level.
|
||||
// +optional
|
||||
optional k8s.io.apimachinery.pkg.runtime.Unknown responseObject = 14;
|
||||
|
||||
// Time the request reached the apiserver.
|
||||
// +optional
|
||||
optional k8s.io.apimachinery.pkg.apis.meta.v1.MicroTime requestReceivedTimestamp = 15;
|
||||
|
||||
// Time the request reached current audit stage.
|
||||
// +optional
|
||||
optional k8s.io.apimachinery.pkg.apis.meta.v1.MicroTime stageTimestamp = 16;
|
||||
|
||||
// Annotations is an unstructured key value map stored with an audit event that may be set by
|
||||
// plugins invoked in the request serving chain, including authentication, authorization and
|
||||
// admission plugins. Note that these annotations are for the audit event, and do not correspond
|
||||
// to the metadata.annotations of the submitted object. Keys should uniquely identify the informing
|
||||
// component to avoid name collisions (e.g. podsecuritypolicy.admission.k8s.io/policy). Values
|
||||
// should be short. Annotations are included in the Metadata level.
|
||||
// +optional
|
||||
map<string, string> annotations = 17;
|
||||
}
|
||||
|
||||
// EventList is a list of audit Events.
|
||||
message EventList {
|
||||
// +optional
|
||||
optional k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;
|
||||
|
||||
repeated Event items = 2;
|
||||
}
|
||||
|
||||
// GroupResources represents resource kinds in an API group.
|
||||
message GroupResources {
|
||||
// Group is the name of the API group that contains the resources.
|
||||
// The empty string represents the core API group.
|
||||
// +optional
|
||||
optional string group = 1;
|
||||
|
||||
// Resources is a list of resources this rule applies to.
|
||||
//
|
||||
// For example:
|
||||
// 'pods' matches pods.
|
||||
// 'pods/log' matches the log subresource of pods.
|
||||
// '*' matches all resources and their subresources.
|
||||
// 'pods/*' matches all subresources of pods.
|
||||
// '*/scale' matches all scale subresources.
|
||||
//
|
||||
// If wildcard is present, the validation rule will ensure resources do not
|
||||
// overlap with each other.
|
||||
//
|
||||
// An empty list implies all resources and subresources in this API groups apply.
|
||||
// +optional
|
||||
repeated string resources = 2;
|
||||
|
||||
// ResourceNames is a list of resource instance names that the policy matches.
|
||||
// Using this field requires Resources to be specified.
|
||||
// An empty list implies that every instance of the resource is matched.
|
||||
// +optional
|
||||
repeated string resourceNames = 3;
|
||||
}
|
||||
|
||||
// ObjectReference contains enough information to let you inspect or modify the referred object.
|
||||
message ObjectReference {
|
||||
// +optional
|
||||
optional string resource = 1;
|
||||
|
||||
// +optional
|
||||
optional string namespace = 2;
|
||||
|
||||
// +optional
|
||||
optional string name = 3;
|
||||
|
||||
// +optional
|
||||
optional string uid = 4;
|
||||
|
||||
// +optional
|
||||
optional string apiVersion = 5;
|
||||
|
||||
// +optional
|
||||
optional string resourceVersion = 6;
|
||||
|
||||
// +optional
|
||||
optional string subresource = 7;
|
||||
}
|
||||
|
||||
// DEPRECATED - This group version of Policy is deprecated by audit.k8s.io/v1/Policy. See the release notes for
|
||||
// more information.
|
||||
// Policy defines the configuration of audit logging, and the rules for how different request
|
||||
// categories are logged.
|
||||
message Policy {
|
||||
// ObjectMeta is included for interoperability with API infrastructure.
|
||||
// +optional
|
||||
optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
|
||||
|
||||
// Rules specify the audit Level a request should be recorded at.
|
||||
// A request may match multiple rules, in which case the FIRST matching rule is used.
|
||||
// The default audit level is None, but can be overridden by a catch-all rule at the end of the list.
|
||||
// PolicyRules are strictly ordered.
|
||||
repeated PolicyRule rules = 2;
|
||||
|
||||
// OmitStages is a list of stages for which no events are created. Note that this can also
|
||||
// be specified per rule in which case the union of both are omitted.
|
||||
// +optional
|
||||
repeated string omitStages = 3;
|
||||
|
||||
// OmitManagedFields indicates whether to omit the managed fields of the request
|
||||
// and response bodies from being written to the API audit log.
|
||||
// This is used as a global default - a value of 'true' will omit the managed fileds,
|
||||
// otherwise the managed fields will be included in the API audit log.
|
||||
// Note that this can also be specified per rule in which case the value specified
|
||||
// in a rule will override the global default.
|
||||
// +optional
|
||||
optional bool omitManagedFields = 4;
|
||||
}
|
||||
|
||||
// PolicyList is a list of audit Policies.
|
||||
message PolicyList {
|
||||
// +optional
|
||||
optional k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;
|
||||
|
||||
repeated Policy items = 2;
|
||||
}
|
||||
|
||||
// PolicyRule maps requests based off metadata to an audit Level.
|
||||
// Requests must match the rules of every field (an intersection of rules).
|
||||
message PolicyRule {
|
||||
// The Level that requests matching this rule are recorded at.
|
||||
optional string level = 1;
|
||||
|
||||
// The users (by authenticated user name) this rule applies to.
|
||||
// An empty list implies every user.
|
||||
// +optional
|
||||
repeated string users = 2;
|
||||
|
||||
// The user groups this rule applies to. A user is considered matching
|
||||
// if it is a member of any of the UserGroups.
|
||||
// An empty list implies every user group.
|
||||
// +optional
|
||||
repeated string userGroups = 3;
|
||||
|
||||
// The verbs that match this rule.
|
||||
// An empty list implies every verb.
|
||||
// +optional
|
||||
repeated string verbs = 4;
|
||||
|
||||
// Resources that this rule matches. An empty list implies all kinds in all API groups.
|
||||
// +optional
|
||||
repeated GroupResources resources = 5;
|
||||
|
||||
// Namespaces that this rule matches.
|
||||
// The empty string "" matches non-namespaced resources.
|
||||
// An empty list implies every namespace.
|
||||
// +optional
|
||||
repeated string namespaces = 6;
|
||||
|
||||
// NonResourceURLs is a set of URL paths that should be audited.
|
||||
// *s are allowed, but only as the full, final step in the path.
|
||||
// Examples:
|
||||
// "/metrics" - Log requests for apiserver metrics
|
||||
// "/healthz*" - Log all health checks
|
||||
// +optional
|
||||
repeated string nonResourceURLs = 7;
|
||||
|
||||
// OmitStages is a list of stages for which no events are created. Note that this can also
|
||||
// be specified policy wide in which case the union of both are omitted.
|
||||
// An empty list means no restrictions will apply.
|
||||
// +optional
|
||||
repeated string omitStages = 8;
|
||||
|
||||
// OmitManagedFields indicates whether to omit the managed fields of the request
|
||||
// and response bodies from being written to the API audit log.
|
||||
// - a value of 'true' will drop the managed fields from the API audit log
|
||||
// - a value of 'false' indicates that the managed fileds should be included
|
||||
// in the API audit log
|
||||
// Note that the value, if specified, in this rule will override the global default
|
||||
// If a value is not specified then the global default specified in
|
||||
// Policy.OmitManagedFields will stand.
|
||||
// +optional
|
||||
optional bool omitManagedFields = 9;
|
||||
}
|
||||
|
||||
@ -1,58 +0,0 @@
|
||||
/*
|
||||
Copyright 2017 The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package v1alpha1
|
||||
|
||||
import (
|
||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
"k8s.io/apimachinery/pkg/runtime"
|
||||
"k8s.io/apimachinery/pkg/runtime/schema"
|
||||
)
|
||||
|
||||
// GroupName is the group name use in this package
|
||||
const GroupName = "audit.k8s.io"
|
||||
|
||||
// SchemeGroupVersion is group version used to register these objects
|
||||
var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1alpha1"}
|
||||
|
||||
// Resource takes an unqualified resource and returns a Group qualified GroupResource
|
||||
func Resource(resource string) schema.GroupResource {
|
||||
return SchemeGroupVersion.WithResource(resource).GroupResource()
|
||||
}
|
||||
|
||||
var (
|
||||
SchemeBuilder runtime.SchemeBuilder
|
||||
localSchemeBuilder = &SchemeBuilder
|
||||
AddToScheme = localSchemeBuilder.AddToScheme
|
||||
)
|
||||
|
||||
func init() {
|
||||
// We only register manually written functions here. The registration of the
|
||||
// generated functions takes place in the generated files. The separation
|
||||
// makes the code compile even when the generated files are missing.
|
||||
localSchemeBuilder.Register(addKnownTypes)
|
||||
}
|
||||
|
||||
func addKnownTypes(scheme *runtime.Scheme) error {
|
||||
scheme.AddKnownTypes(SchemeGroupVersion,
|
||||
&Event{},
|
||||
&EventList{},
|
||||
&Policy{},
|
||||
&PolicyList{},
|
||||
)
|
||||
metav1.AddToGroupVersion(scheme, SchemeGroupVersion)
|
||||
return nil
|
||||
}
|
||||
@ -1,323 +0,0 @@
|
||||
/*
|
||||
Copyright 2017 The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package v1alpha1
|
||||
|
||||
import (
|
||||
authnv1 "k8s.io/api/authentication/v1"
|
||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
"k8s.io/apimachinery/pkg/runtime"
|
||||
"k8s.io/apimachinery/pkg/types"
|
||||
)
|
||||
|
||||
// Header keys used by the audit system.
|
||||
const (
|
||||
// Header to hold the audit ID as the request is propagated through the serving hierarchy. The
|
||||
// Audit-ID header should be set by the first server to receive the request (e.g. the federation
|
||||
// server or kube-aggregator).
|
||||
//
|
||||
// Audit ID is also returned to client by http response header.
|
||||
// It's not guaranteed Audit-Id http header is sent for all requests. When kube-apiserver didn't
|
||||
// audit the events according to the audit policy, no Audit-ID is returned. Also, for request to
|
||||
// pods/exec, pods/attach, pods/proxy, kube-apiserver works like a proxy and redirect the request
|
||||
// to kubelet node, users will only get http headers sent from kubelet node, so no Audit-ID is
|
||||
// sent when users run command like "kubectl exec" or "kubectl attach".
|
||||
HeaderAuditID = "Audit-ID"
|
||||
)
|
||||
|
||||
// Level defines the amount of information logged during auditing
|
||||
type Level string
|
||||
|
||||
// Valid audit levels
|
||||
const (
|
||||
// LevelNone disables auditing
|
||||
LevelNone Level = "None"
|
||||
// LevelMetadata provides the basic level of auditing.
|
||||
LevelMetadata Level = "Metadata"
|
||||
// LevelRequest provides Metadata level of auditing, and additionally
|
||||
// logs the request object (does not apply for non-resource requests).
|
||||
LevelRequest Level = "Request"
|
||||
// LevelRequestResponse provides Request level of auditing, and additionally
|
||||
// logs the response object (does not apply for non-resource requests).
|
||||
LevelRequestResponse Level = "RequestResponse"
|
||||
)
|
||||
|
||||
// Stage defines the stages in request handling that audit events may be generated.
|
||||
type Stage string
|
||||
|
||||
// Valid audit stages.
|
||||
const (
|
||||
// The stage for events generated as soon as the audit handler receives the request, and before it
|
||||
// is delegated down the handler chain.
|
||||
StageRequestReceived Stage = "RequestReceived"
|
||||
// The stage for events generated once the response headers are sent, but before the response body
|
||||
// is sent. This stage is only generated for long-running requests (e.g. watch).
|
||||
StageResponseStarted Stage = "ResponseStarted"
|
||||
// The stage for events generated once the response body has been completed, and no more bytes
|
||||
// will be sent.
|
||||
StageResponseComplete Stage = "ResponseComplete"
|
||||
// The stage for events generated when a panic occurred.
|
||||
StagePanic Stage = "Panic"
|
||||
)
|
||||
|
||||
// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
|
||||
// +k8s:prerelease-lifecycle-gen:introduced=1.7
|
||||
// +k8s:prerelease-lifecycle-gen:deprecated=1.21
|
||||
// +k8s:prerelease-lifecycle-gen:replacement=audit.k8s.io,v1,Event
|
||||
|
||||
// DEPRECATED - This group version of Event is deprecated by audit.k8s.io/v1/Event. See the release notes for
|
||||
// more information.
|
||||
// Event captures all the information that can be included in an API audit log.
|
||||
type Event struct {
|
||||
metav1.TypeMeta `json:",inline"`
|
||||
// ObjectMeta is included for interoperability with API infrastructure.
|
||||
// +optional
|
||||
metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
|
||||
|
||||
// AuditLevel at which event was generated
|
||||
Level Level `json:"level" protobuf:"bytes,2,opt,name=level,casttype=Level"`
|
||||
|
||||
// Time the request reached the apiserver.
|
||||
Timestamp metav1.Time `json:"timestamp" protobuf:"bytes,3,opt,name=timestamp"`
|
||||
// Unique audit ID, generated for each request.
|
||||
AuditID types.UID `json:"auditID" protobuf:"bytes,4,opt,name=auditID,casttype=k8s.io/apimachinery/pkg/types.UID"`
|
||||
// Stage of the request handling when this event instance was generated.
|
||||
Stage Stage `json:"stage" protobuf:"bytes,5,opt,name=stage,casttype=Stage"`
|
||||
|
||||
// RequestURI is the request URI as sent by the client to a server.
|
||||
RequestURI string `json:"requestURI" protobuf:"bytes,6,opt,name=requestURI"`
|
||||
// Verb is the kubernetes verb associated with the request.
|
||||
// For non-resource requests, this is the lower-cased HTTP method.
|
||||
Verb string `json:"verb" protobuf:"bytes,7,opt,name=verb"`
|
||||
// Authenticated user information.
|
||||
User authnv1.UserInfo `json:"user" protobuf:"bytes,8,opt,name=user"`
|
||||
// Impersonated user information.
|
||||
// +optional
|
||||
ImpersonatedUser *authnv1.UserInfo `json:"impersonatedUser,omitempty" protobuf:"bytes,9,opt,name=impersonatedUser"`
|
||||
// Source IPs, from where the request originated and intermediate proxies.
|
||||
// +optional
|
||||
SourceIPs []string `json:"sourceIPs,omitempty" protobuf:"bytes,10,rep,name=sourceIPs"`
|
||||
// UserAgent records the user agent string reported by the client.
|
||||
// Note that the UserAgent is provided by the client, and must not be trusted.
|
||||
// +optional
|
||||
UserAgent string `json:"userAgent,omitempty" protobuf:"bytes,18,opt,name=userAgent"`
|
||||
// Object reference this request is targeted at.
|
||||
// Does not apply for List-type requests, or non-resource requests.
|
||||
// +optional
|
||||
ObjectRef *ObjectReference `json:"objectRef,omitempty" protobuf:"bytes,11,opt,name=objectRef"`
|
||||
// The response status, populated even when the ResponseObject is not a Status type.
|
||||
// For successful responses, this will only include the Code and StatusSuccess.
|
||||
// For non-status type error responses, this will be auto-populated with the error Message.
|
||||
// +optional
|
||||
ResponseStatus *metav1.Status `json:"responseStatus,omitempty" protobuf:"bytes,12,opt,name=responseStatus"`
|
||||
|
||||
// API object from the request, in JSON format. The RequestObject is recorded as-is in the request
|
||||
// (possibly re-encoded as JSON), prior to version conversion, defaulting, admission or
|
||||
// merging. It is an external versioned object type, and may not be a valid object on its own.
|
||||
// Omitted for non-resource requests. Only logged at Request Level and higher.
|
||||
// +optional
|
||||
RequestObject *runtime.Unknown `json:"requestObject,omitempty" protobuf:"bytes,13,opt,name=requestObject"`
|
||||
// API object returned in the response, in JSON. The ResponseObject is recorded after conversion
|
||||
// to the external type, and serialized as JSON. Omitted for non-resource requests. Only logged
|
||||
// at Response Level.
|
||||
// +optional
|
||||
ResponseObject *runtime.Unknown `json:"responseObject,omitempty" protobuf:"bytes,14,opt,name=responseObject"`
|
||||
// Time the request reached the apiserver.
|
||||
// +optional
|
||||
RequestReceivedTimestamp metav1.MicroTime `json:"requestReceivedTimestamp" protobuf:"bytes,15,opt,name=requestReceivedTimestamp"`
|
||||
// Time the request reached current audit stage.
|
||||
// +optional
|
||||
StageTimestamp metav1.MicroTime `json:"stageTimestamp" protobuf:"bytes,16,opt,name=stageTimestamp"`
|
||||
|
||||
// Annotations is an unstructured key value map stored with an audit event that may be set by
|
||||
// plugins invoked in the request serving chain, including authentication, authorization and
|
||||
// admission plugins. Note that these annotations are for the audit event, and do not correspond
|
||||
// to the metadata.annotations of the submitted object. Keys should uniquely identify the informing
|
||||
// component to avoid name collisions (e.g. podsecuritypolicy.admission.k8s.io/policy). Values
|
||||
// should be short. Annotations are included in the Metadata level.
|
||||
// +optional
|
||||
Annotations map[string]string `json:"annotations,omitempty" protobuf:"bytes,17,rep,name=annotations"`
|
||||
}
|
||||
|
||||
// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
|
||||
// +k8s:prerelease-lifecycle-gen:introduced=1.7
|
||||
// +k8s:prerelease-lifecycle-gen:deprecated=1.21
|
||||
// +k8s:prerelease-lifecycle-gen:replacement=audit.k8s.io,v1,EventList
|
||||
|
||||
// EventList is a list of audit Events.
|
||||
type EventList struct {
|
||||
metav1.TypeMeta `json:",inline"`
|
||||
// +optional
|
||||
metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
|
||||
|
||||
Items []Event `json:"items" protobuf:"bytes,2,rep,name=items"`
|
||||
}
|
||||
|
||||
// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
|
||||
// +k8s:prerelease-lifecycle-gen:introduced=1.7
|
||||
// +k8s:prerelease-lifecycle-gen:deprecated=1.21
|
||||
// +k8s:prerelease-lifecycle-gen:replacement=audit.k8s.io,v1,Policy
|
||||
|
||||
// DEPRECATED - This group version of Policy is deprecated by audit.k8s.io/v1/Policy. See the release notes for
|
||||
// more information.
|
||||
// Policy defines the configuration of audit logging, and the rules for how different request
|
||||
// categories are logged.
|
||||
type Policy struct {
|
||||
metav1.TypeMeta `json:",inline"`
|
||||
// ObjectMeta is included for interoperability with API infrastructure.
|
||||
// +optional
|
||||
metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
|
||||
|
||||
// Rules specify the audit Level a request should be recorded at.
|
||||
// A request may match multiple rules, in which case the FIRST matching rule is used.
|
||||
// The default audit level is None, but can be overridden by a catch-all rule at the end of the list.
|
||||
// PolicyRules are strictly ordered.
|
||||
Rules []PolicyRule `json:"rules" protobuf:"bytes,2,rep,name=rules"`
|
||||
|
||||
// OmitStages is a list of stages for which no events are created. Note that this can also
|
||||
// be specified per rule in which case the union of both are omitted.
|
||||
// +optional
|
||||
OmitStages []Stage `json:"omitStages,omitempty" protobuf:"bytes,3,rep,name=omitStages"`
|
||||
|
||||
// OmitManagedFields indicates whether to omit the managed fields of the request
|
||||
// and response bodies from being written to the API audit log.
|
||||
// This is used as a global default - a value of 'true' will omit the managed fileds,
|
||||
// otherwise the managed fields will be included in the API audit log.
|
||||
// Note that this can also be specified per rule in which case the value specified
|
||||
// in a rule will override the global default.
|
||||
// +optional
|
||||
OmitManagedFields bool `json:"omitManagedFields,omitempty" protobuf:"varint,4,opt,name=omitManagedFields"`
|
||||
}
|
||||
|
||||
// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
|
||||
// +k8s:prerelease-lifecycle-gen:introduced=1.7
|
||||
// +k8s:prerelease-lifecycle-gen:deprecated=1.21
|
||||
// +k8s:prerelease-lifecycle-gen:replacement=audit.k8s.io,v1,PolicyList
|
||||
|
||||
// PolicyList is a list of audit Policies.
|
||||
type PolicyList struct {
|
||||
metav1.TypeMeta `json:",inline"`
|
||||
// +optional
|
||||
metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
|
||||
|
||||
Items []Policy `json:"items" protobuf:"bytes,2,rep,name=items"`
|
||||
}
|
||||
|
||||
// PolicyRule maps requests based off metadata to an audit Level.
|
||||
// Requests must match the rules of every field (an intersection of rules).
|
||||
type PolicyRule struct {
|
||||
// The Level that requests matching this rule are recorded at.
|
||||
Level Level `json:"level" protobuf:"bytes,1,opt,name=level,casttype=Level"`
|
||||
|
||||
// The users (by authenticated user name) this rule applies to.
|
||||
// An empty list implies every user.
|
||||
// +optional
|
||||
Users []string `json:"users,omitempty" protobuf:"bytes,2,rep,name=users"`
|
||||
// The user groups this rule applies to. A user is considered matching
|
||||
// if it is a member of any of the UserGroups.
|
||||
// An empty list implies every user group.
|
||||
// +optional
|
||||
UserGroups []string `json:"userGroups,omitempty" protobuf:"bytes,3,rep,name=userGroups"`
|
||||
|
||||
// The verbs that match this rule.
|
||||
// An empty list implies every verb.
|
||||
// +optional
|
||||
Verbs []string `json:"verbs,omitempty" protobuf:"bytes,4,rep,name=verbs"`
|
||||
|
||||
// Rules can apply to API resources (such as "pods" or "secrets"),
|
||||
// non-resource URL paths (such as "/api"), or neither, but not both.
|
||||
// If neither is specified, the rule is treated as a default for all URLs.
|
||||
|
||||
// Resources that this rule matches. An empty list implies all kinds in all API groups.
|
||||
// +optional
|
||||
Resources []GroupResources `json:"resources,omitempty" protobuf:"bytes,5,rep,name=resources"`
|
||||
// Namespaces that this rule matches.
|
||||
// The empty string "" matches non-namespaced resources.
|
||||
// An empty list implies every namespace.
|
||||
// +optional
|
||||
Namespaces []string `json:"namespaces,omitempty" protobuf:"bytes,6,rep,name=namespaces"`
|
||||
|
||||
// NonResourceURLs is a set of URL paths that should be audited.
|
||||
// *s are allowed, but only as the full, final step in the path.
|
||||
// Examples:
|
||||
// "/metrics" - Log requests for apiserver metrics
|
||||
// "/healthz*" - Log all health checks
|
||||
// +optional
|
||||
NonResourceURLs []string `json:"nonResourceURLs,omitempty" protobuf:"bytes,7,rep,name=nonResourceURLs"`
|
||||
|
||||
// OmitStages is a list of stages for which no events are created. Note that this can also
|
||||
// be specified policy wide in which case the union of both are omitted.
|
||||
// An empty list means no restrictions will apply.
|
||||
// +optional
|
||||
OmitStages []Stage `json:"omitStages,omitempty" protobuf:"bytes,8,rep,name=omitStages"`
|
||||
|
||||
// OmitManagedFields indicates whether to omit the managed fields of the request
|
||||
// and response bodies from being written to the API audit log.
|
||||
// - a value of 'true' will drop the managed fields from the API audit log
|
||||
// - a value of 'false' indicates that the managed fileds should be included
|
||||
// in the API audit log
|
||||
// Note that the value, if specified, in this rule will override the global default
|
||||
// If a value is not specified then the global default specified in
|
||||
// Policy.OmitManagedFields will stand.
|
||||
// +optional
|
||||
OmitManagedFields *bool `json:"omitManagedFields,omitempty" protobuf:"varint,9,opt,name=omitManagedFields"`
|
||||
}
|
||||
|
||||
// GroupResources represents resource kinds in an API group.
|
||||
type GroupResources struct {
|
||||
// Group is the name of the API group that contains the resources.
|
||||
// The empty string represents the core API group.
|
||||
// +optional
|
||||
Group string `json:"group,omitempty" protobuf:"bytes,1,opt,name=group"`
|
||||
// Resources is a list of resources this rule applies to.
|
||||
//
|
||||
// For example:
|
||||
// 'pods' matches pods.
|
||||
// 'pods/log' matches the log subresource of pods.
|
||||
// '*' matches all resources and their subresources.
|
||||
// 'pods/*' matches all subresources of pods.
|
||||
// '*/scale' matches all scale subresources.
|
||||
//
|
||||
// If wildcard is present, the validation rule will ensure resources do not
|
||||
// overlap with each other.
|
||||
//
|
||||
// An empty list implies all resources and subresources in this API groups apply.
|
||||
// +optional
|
||||
Resources []string `json:"resources,omitempty" protobuf:"bytes,2,rep,name=resources"`
|
||||
// ResourceNames is a list of resource instance names that the policy matches.
|
||||
// Using this field requires Resources to be specified.
|
||||
// An empty list implies that every instance of the resource is matched.
|
||||
// +optional
|
||||
ResourceNames []string `json:"resourceNames,omitempty" protobuf:"bytes,3,rep,name=resourceNames"`
|
||||
}
|
||||
|
||||
// ObjectReference contains enough information to let you inspect or modify the referred object.
|
||||
type ObjectReference struct {
|
||||
// +optional
|
||||
Resource string `json:"resource,omitempty" protobuf:"bytes,1,opt,name=resource"`
|
||||
// +optional
|
||||
Namespace string `json:"namespace,omitempty" protobuf:"bytes,2,opt,name=namespace"`
|
||||
// +optional
|
||||
Name string `json:"name,omitempty" protobuf:"bytes,3,opt,name=name"`
|
||||
// +optional
|
||||
UID types.UID `json:"uid,omitempty" protobuf:"bytes,4,opt,name=uid,casttype=k8s.io/apimachinery/pkg/types.UID"`
|
||||
// +optional
|
||||
APIVersion string `json:"apiVersion,omitempty" protobuf:"bytes,5,opt,name=apiVersion"`
|
||||
// +optional
|
||||
ResourceVersion string `json:"resourceVersion,omitempty" protobuf:"bytes,6,opt,name=resourceVersion"`
|
||||
// +optional
|
||||
Subresource string `json:"subresource,omitempty" protobuf:"bytes,7,opt,name=subresource"`
|
||||
}
|
||||
@ -1,344 +0,0 @@
|
||||
//go:build !ignore_autogenerated
|
||||
// +build !ignore_autogenerated
|
||||
|
||||
/*
|
||||
Copyright The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
// Code generated by conversion-gen. DO NOT EDIT.
|
||||
|
||||
package v1alpha1
|
||||
|
||||
import (
|
||||
unsafe "unsafe"
|
||||
|
||||
v1 "k8s.io/api/authentication/v1"
|
||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
conversion "k8s.io/apimachinery/pkg/conversion"
|
||||
runtime "k8s.io/apimachinery/pkg/runtime"
|
||||
types "k8s.io/apimachinery/pkg/types"
|
||||
audit "k8s.io/apiserver/pkg/apis/audit"
|
||||
)
|
||||
|
||||
func init() {
|
||||
localSchemeBuilder.Register(RegisterConversions)
|
||||
}
|
||||
|
||||
// RegisterConversions adds conversion functions to the given scheme.
|
||||
// Public to allow building arbitrary schemes.
|
||||
func RegisterConversions(s *runtime.Scheme) error {
|
||||
if err := s.AddGeneratedConversionFunc((*EventList)(nil), (*audit.EventList)(nil), func(a, b interface{}, scope conversion.Scope) error {
|
||||
return Convert_v1alpha1_EventList_To_audit_EventList(a.(*EventList), b.(*audit.EventList), scope)
|
||||
}); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := s.AddGeneratedConversionFunc((*audit.EventList)(nil), (*EventList)(nil), func(a, b interface{}, scope conversion.Scope) error {
|
||||
return Convert_audit_EventList_To_v1alpha1_EventList(a.(*audit.EventList), b.(*EventList), scope)
|
||||
}); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := s.AddGeneratedConversionFunc((*GroupResources)(nil), (*audit.GroupResources)(nil), func(a, b interface{}, scope conversion.Scope) error {
|
||||
return Convert_v1alpha1_GroupResources_To_audit_GroupResources(a.(*GroupResources), b.(*audit.GroupResources), scope)
|
||||
}); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := s.AddGeneratedConversionFunc((*audit.GroupResources)(nil), (*GroupResources)(nil), func(a, b interface{}, scope conversion.Scope) error {
|
||||
return Convert_audit_GroupResources_To_v1alpha1_GroupResources(a.(*audit.GroupResources), b.(*GroupResources), scope)
|
||||
}); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := s.AddGeneratedConversionFunc((*Policy)(nil), (*audit.Policy)(nil), func(a, b interface{}, scope conversion.Scope) error {
|
||||
return Convert_v1alpha1_Policy_To_audit_Policy(a.(*Policy), b.(*audit.Policy), scope)
|
||||
}); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := s.AddGeneratedConversionFunc((*audit.Policy)(nil), (*Policy)(nil), func(a, b interface{}, scope conversion.Scope) error {
|
||||
return Convert_audit_Policy_To_v1alpha1_Policy(a.(*audit.Policy), b.(*Policy), scope)
|
||||
}); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := s.AddGeneratedConversionFunc((*PolicyList)(nil), (*audit.PolicyList)(nil), func(a, b interface{}, scope conversion.Scope) error {
|
||||
return Convert_v1alpha1_PolicyList_To_audit_PolicyList(a.(*PolicyList), b.(*audit.PolicyList), scope)
|
||||
}); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := s.AddGeneratedConversionFunc((*audit.PolicyList)(nil), (*PolicyList)(nil), func(a, b interface{}, scope conversion.Scope) error {
|
||||
return Convert_audit_PolicyList_To_v1alpha1_PolicyList(a.(*audit.PolicyList), b.(*PolicyList), scope)
|
||||
}); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := s.AddGeneratedConversionFunc((*PolicyRule)(nil), (*audit.PolicyRule)(nil), func(a, b interface{}, scope conversion.Scope) error {
|
||||
return Convert_v1alpha1_PolicyRule_To_audit_PolicyRule(a.(*PolicyRule), b.(*audit.PolicyRule), scope)
|
||||
}); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := s.AddGeneratedConversionFunc((*audit.PolicyRule)(nil), (*PolicyRule)(nil), func(a, b interface{}, scope conversion.Scope) error {
|
||||
return Convert_audit_PolicyRule_To_v1alpha1_PolicyRule(a.(*audit.PolicyRule), b.(*PolicyRule), scope)
|
||||
}); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := s.AddConversionFunc((*audit.Event)(nil), (*Event)(nil), func(a, b interface{}, scope conversion.Scope) error {
|
||||
return Convert_audit_Event_To_v1alpha1_Event(a.(*audit.Event), b.(*Event), scope)
|
||||
}); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := s.AddConversionFunc((*audit.ObjectReference)(nil), (*ObjectReference)(nil), func(a, b interface{}, scope conversion.Scope) error {
|
||||
return Convert_audit_ObjectReference_To_v1alpha1_ObjectReference(a.(*audit.ObjectReference), b.(*ObjectReference), scope)
|
||||
}); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := s.AddConversionFunc((*Event)(nil), (*audit.Event)(nil), func(a, b interface{}, scope conversion.Scope) error {
|
||||
return Convert_v1alpha1_Event_To_audit_Event(a.(*Event), b.(*audit.Event), scope)
|
||||
}); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := s.AddConversionFunc((*ObjectReference)(nil), (*audit.ObjectReference)(nil), func(a, b interface{}, scope conversion.Scope) error {
|
||||
return Convert_v1alpha1_ObjectReference_To_audit_ObjectReference(a.(*ObjectReference), b.(*audit.ObjectReference), scope)
|
||||
}); err != nil {
|
||||
return err
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func autoConvert_v1alpha1_Event_To_audit_Event(in *Event, out *audit.Event, s conversion.Scope) error {
|
||||
// WARNING: in.ObjectMeta requires manual conversion: does not exist in peer-type
|
||||
out.Level = audit.Level(in.Level)
|
||||
// WARNING: in.Timestamp requires manual conversion: does not exist in peer-type
|
||||
out.AuditID = types.UID(in.AuditID)
|
||||
out.Stage = audit.Stage(in.Stage)
|
||||
out.RequestURI = in.RequestURI
|
||||
out.Verb = in.Verb
|
||||
out.User = in.User
|
||||
out.ImpersonatedUser = (*v1.UserInfo)(unsafe.Pointer(in.ImpersonatedUser))
|
||||
out.SourceIPs = *(*[]string)(unsafe.Pointer(&in.SourceIPs))
|
||||
out.UserAgent = in.UserAgent
|
||||
if in.ObjectRef != nil {
|
||||
in, out := &in.ObjectRef, &out.ObjectRef
|
||||
*out = new(audit.ObjectReference)
|
||||
if err := Convert_v1alpha1_ObjectReference_To_audit_ObjectReference(*in, *out, s); err != nil {
|
||||
return err
|
||||
}
|
||||
} else {
|
||||
out.ObjectRef = nil
|
||||
}
|
||||
out.ResponseStatus = (*metav1.Status)(unsafe.Pointer(in.ResponseStatus))
|
||||
out.RequestObject = (*runtime.Unknown)(unsafe.Pointer(in.RequestObject))
|
||||
out.ResponseObject = (*runtime.Unknown)(unsafe.Pointer(in.ResponseObject))
|
||||
out.RequestReceivedTimestamp = in.RequestReceivedTimestamp
|
||||
out.StageTimestamp = in.StageTimestamp
|
||||
out.Annotations = *(*map[string]string)(unsafe.Pointer(&in.Annotations))
|
||||
return nil
|
||||
}
|
||||
|
||||
func autoConvert_audit_Event_To_v1alpha1_Event(in *audit.Event, out *Event, s conversion.Scope) error {
|
||||
out.Level = Level(in.Level)
|
||||
out.AuditID = types.UID(in.AuditID)
|
||||
out.Stage = Stage(in.Stage)
|
||||
out.RequestURI = in.RequestURI
|
||||
out.Verb = in.Verb
|
||||
out.User = in.User
|
||||
out.ImpersonatedUser = (*v1.UserInfo)(unsafe.Pointer(in.ImpersonatedUser))
|
||||
out.SourceIPs = *(*[]string)(unsafe.Pointer(&in.SourceIPs))
|
||||
out.UserAgent = in.UserAgent
|
||||
if in.ObjectRef != nil {
|
||||
in, out := &in.ObjectRef, &out.ObjectRef
|
||||
*out = new(ObjectReference)
|
||||
if err := Convert_audit_ObjectReference_To_v1alpha1_ObjectReference(*in, *out, s); err != nil {
|
||||
return err
|
||||
}
|
||||
} else {
|
||||
out.ObjectRef = nil
|
||||
}
|
||||
out.ResponseStatus = (*metav1.Status)(unsafe.Pointer(in.ResponseStatus))
|
||||
out.RequestObject = (*runtime.Unknown)(unsafe.Pointer(in.RequestObject))
|
||||
out.ResponseObject = (*runtime.Unknown)(unsafe.Pointer(in.ResponseObject))
|
||||
out.RequestReceivedTimestamp = in.RequestReceivedTimestamp
|
||||
out.StageTimestamp = in.StageTimestamp
|
||||
out.Annotations = *(*map[string]string)(unsafe.Pointer(&in.Annotations))
|
||||
return nil
|
||||
}
|
||||
|
||||
func autoConvert_v1alpha1_EventList_To_audit_EventList(in *EventList, out *audit.EventList, s conversion.Scope) error {
|
||||
out.ListMeta = in.ListMeta
|
||||
if in.Items != nil {
|
||||
in, out := &in.Items, &out.Items
|
||||
*out = make([]audit.Event, len(*in))
|
||||
for i := range *in {
|
||||
if err := Convert_v1alpha1_Event_To_audit_Event(&(*in)[i], &(*out)[i], s); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
} else {
|
||||
out.Items = nil
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// Convert_v1alpha1_EventList_To_audit_EventList is an autogenerated conversion function.
|
||||
func Convert_v1alpha1_EventList_To_audit_EventList(in *EventList, out *audit.EventList, s conversion.Scope) error {
|
||||
return autoConvert_v1alpha1_EventList_To_audit_EventList(in, out, s)
|
||||
}
|
||||
|
||||
func autoConvert_audit_EventList_To_v1alpha1_EventList(in *audit.EventList, out *EventList, s conversion.Scope) error {
|
||||
out.ListMeta = in.ListMeta
|
||||
if in.Items != nil {
|
||||
in, out := &in.Items, &out.Items
|
||||
*out = make([]Event, len(*in))
|
||||
for i := range *in {
|
||||
if err := Convert_audit_Event_To_v1alpha1_Event(&(*in)[i], &(*out)[i], s); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
} else {
|
||||
out.Items = nil
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// Convert_audit_EventList_To_v1alpha1_EventList is an autogenerated conversion function.
|
||||
func Convert_audit_EventList_To_v1alpha1_EventList(in *audit.EventList, out *EventList, s conversion.Scope) error {
|
||||
return autoConvert_audit_EventList_To_v1alpha1_EventList(in, out, s)
|
||||
}
|
||||
|
||||
func autoConvert_v1alpha1_GroupResources_To_audit_GroupResources(in *GroupResources, out *audit.GroupResources, s conversion.Scope) error {
|
||||
out.Group = in.Group
|
||||
out.Resources = *(*[]string)(unsafe.Pointer(&in.Resources))
|
||||
out.ResourceNames = *(*[]string)(unsafe.Pointer(&in.ResourceNames))
|
||||
return nil
|
||||
}
|
||||
|
||||
// Convert_v1alpha1_GroupResources_To_audit_GroupResources is an autogenerated conversion function.
|
||||
func Convert_v1alpha1_GroupResources_To_audit_GroupResources(in *GroupResources, out *audit.GroupResources, s conversion.Scope) error {
|
||||
return autoConvert_v1alpha1_GroupResources_To_audit_GroupResources(in, out, s)
|
||||
}
|
||||
|
||||
func autoConvert_audit_GroupResources_To_v1alpha1_GroupResources(in *audit.GroupResources, out *GroupResources, s conversion.Scope) error {
|
||||
out.Group = in.Group
|
||||
out.Resources = *(*[]string)(unsafe.Pointer(&in.Resources))
|
||||
out.ResourceNames = *(*[]string)(unsafe.Pointer(&in.ResourceNames))
|
||||
return nil
|
||||
}
|
||||
|
||||
// Convert_audit_GroupResources_To_v1alpha1_GroupResources is an autogenerated conversion function.
|
||||
func Convert_audit_GroupResources_To_v1alpha1_GroupResources(in *audit.GroupResources, out *GroupResources, s conversion.Scope) error {
|
||||
return autoConvert_audit_GroupResources_To_v1alpha1_GroupResources(in, out, s)
|
||||
}
|
||||
|
||||
func autoConvert_v1alpha1_ObjectReference_To_audit_ObjectReference(in *ObjectReference, out *audit.ObjectReference, s conversion.Scope) error {
|
||||
out.Resource = in.Resource
|
||||
out.Namespace = in.Namespace
|
||||
out.Name = in.Name
|
||||
out.UID = types.UID(in.UID)
|
||||
out.APIVersion = in.APIVersion
|
||||
out.ResourceVersion = in.ResourceVersion
|
||||
out.Subresource = in.Subresource
|
||||
return nil
|
||||
}
|
||||
|
||||
func autoConvert_audit_ObjectReference_To_v1alpha1_ObjectReference(in *audit.ObjectReference, out *ObjectReference, s conversion.Scope) error {
|
||||
out.Resource = in.Resource
|
||||
out.Namespace = in.Namespace
|
||||
out.Name = in.Name
|
||||
out.UID = types.UID(in.UID)
|
||||
// WARNING: in.APIGroup requires manual conversion: does not exist in peer-type
|
||||
out.APIVersion = in.APIVersion
|
||||
out.ResourceVersion = in.ResourceVersion
|
||||
out.Subresource = in.Subresource
|
||||
return nil
|
||||
}
|
||||
|
||||
func autoConvert_v1alpha1_Policy_To_audit_Policy(in *Policy, out *audit.Policy, s conversion.Scope) error {
|
||||
out.ObjectMeta = in.ObjectMeta
|
||||
out.Rules = *(*[]audit.PolicyRule)(unsafe.Pointer(&in.Rules))
|
||||
out.OmitStages = *(*[]audit.Stage)(unsafe.Pointer(&in.OmitStages))
|
||||
out.OmitManagedFields = in.OmitManagedFields
|
||||
return nil
|
||||
}
|
||||
|
||||
// Convert_v1alpha1_Policy_To_audit_Policy is an autogenerated conversion function.
|
||||
func Convert_v1alpha1_Policy_To_audit_Policy(in *Policy, out *audit.Policy, s conversion.Scope) error {
|
||||
return autoConvert_v1alpha1_Policy_To_audit_Policy(in, out, s)
|
||||
}
|
||||
|
||||
func autoConvert_audit_Policy_To_v1alpha1_Policy(in *audit.Policy, out *Policy, s conversion.Scope) error {
|
||||
out.ObjectMeta = in.ObjectMeta
|
||||
out.Rules = *(*[]PolicyRule)(unsafe.Pointer(&in.Rules))
|
||||
out.OmitStages = *(*[]Stage)(unsafe.Pointer(&in.OmitStages))
|
||||
out.OmitManagedFields = in.OmitManagedFields
|
||||
return nil
|
||||
}
|
||||
|
||||
// Convert_audit_Policy_To_v1alpha1_Policy is an autogenerated conversion function.
|
||||
func Convert_audit_Policy_To_v1alpha1_Policy(in *audit.Policy, out *Policy, s conversion.Scope) error {
|
||||
return autoConvert_audit_Policy_To_v1alpha1_Policy(in, out, s)
|
||||
}
|
||||
|
||||
func autoConvert_v1alpha1_PolicyList_To_audit_PolicyList(in *PolicyList, out *audit.PolicyList, s conversion.Scope) error {
|
||||
out.ListMeta = in.ListMeta
|
||||
out.Items = *(*[]audit.Policy)(unsafe.Pointer(&in.Items))
|
||||
return nil
|
||||
}
|
||||
|
||||
// Convert_v1alpha1_PolicyList_To_audit_PolicyList is an autogenerated conversion function.
|
||||
func Convert_v1alpha1_PolicyList_To_audit_PolicyList(in *PolicyList, out *audit.PolicyList, s conversion.Scope) error {
|
||||
return autoConvert_v1alpha1_PolicyList_To_audit_PolicyList(in, out, s)
|
||||
}
|
||||
|
||||
func autoConvert_audit_PolicyList_To_v1alpha1_PolicyList(in *audit.PolicyList, out *PolicyList, s conversion.Scope) error {
|
||||
out.ListMeta = in.ListMeta
|
||||
out.Items = *(*[]Policy)(unsafe.Pointer(&in.Items))
|
||||
return nil
|
||||
}
|
||||
|
||||
// Convert_audit_PolicyList_To_v1alpha1_PolicyList is an autogenerated conversion function.
|
||||
func Convert_audit_PolicyList_To_v1alpha1_PolicyList(in *audit.PolicyList, out *PolicyList, s conversion.Scope) error {
|
||||
return autoConvert_audit_PolicyList_To_v1alpha1_PolicyList(in, out, s)
|
||||
}
|
||||
|
||||
func autoConvert_v1alpha1_PolicyRule_To_audit_PolicyRule(in *PolicyRule, out *audit.PolicyRule, s conversion.Scope) error {
|
||||
out.Level = audit.Level(in.Level)
|
||||
out.Users = *(*[]string)(unsafe.Pointer(&in.Users))
|
||||
out.UserGroups = *(*[]string)(unsafe.Pointer(&in.UserGroups))
|
||||
out.Verbs = *(*[]string)(unsafe.Pointer(&in.Verbs))
|
||||
out.Resources = *(*[]audit.GroupResources)(unsafe.Pointer(&in.Resources))
|
||||
out.Namespaces = *(*[]string)(unsafe.Pointer(&in.Namespaces))
|
||||
out.NonResourceURLs = *(*[]string)(unsafe.Pointer(&in.NonResourceURLs))
|
||||
out.OmitStages = *(*[]audit.Stage)(unsafe.Pointer(&in.OmitStages))
|
||||
out.OmitManagedFields = (*bool)(unsafe.Pointer(in.OmitManagedFields))
|
||||
return nil
|
||||
}
|
||||
|
||||
// Convert_v1alpha1_PolicyRule_To_audit_PolicyRule is an autogenerated conversion function.
|
||||
func Convert_v1alpha1_PolicyRule_To_audit_PolicyRule(in *PolicyRule, out *audit.PolicyRule, s conversion.Scope) error {
|
||||
return autoConvert_v1alpha1_PolicyRule_To_audit_PolicyRule(in, out, s)
|
||||
}
|
||||
|
||||
func autoConvert_audit_PolicyRule_To_v1alpha1_PolicyRule(in *audit.PolicyRule, out *PolicyRule, s conversion.Scope) error {
|
||||
out.Level = Level(in.Level)
|
||||
out.Users = *(*[]string)(unsafe.Pointer(&in.Users))
|
||||
out.UserGroups = *(*[]string)(unsafe.Pointer(&in.UserGroups))
|
||||
out.Verbs = *(*[]string)(unsafe.Pointer(&in.Verbs))
|
||||
out.Resources = *(*[]GroupResources)(unsafe.Pointer(&in.Resources))
|
||||
out.Namespaces = *(*[]string)(unsafe.Pointer(&in.Namespaces))
|
||||
out.NonResourceURLs = *(*[]string)(unsafe.Pointer(&in.NonResourceURLs))
|
||||
out.OmitStages = *(*[]Stage)(unsafe.Pointer(&in.OmitStages))
|
||||
out.OmitManagedFields = (*bool)(unsafe.Pointer(in.OmitManagedFields))
|
||||
return nil
|
||||
}
|
||||
|
||||
// Convert_audit_PolicyRule_To_v1alpha1_PolicyRule is an autogenerated conversion function.
|
||||
func Convert_audit_PolicyRule_To_v1alpha1_PolicyRule(in *audit.PolicyRule, out *PolicyRule, s conversion.Scope) error {
|
||||
return autoConvert_audit_PolicyRule_To_v1alpha1_PolicyRule(in, out, s)
|
||||
}
|
||||
@ -1,299 +0,0 @@
|
||||
//go:build !ignore_autogenerated
|
||||
// +build !ignore_autogenerated
|
||||
|
||||
/*
|
||||
Copyright The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
// Code generated by deepcopy-gen. DO NOT EDIT.
|
||||
|
||||
package v1alpha1
|
||||
|
||||
import (
|
||||
v1 "k8s.io/api/authentication/v1"
|
||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
runtime "k8s.io/apimachinery/pkg/runtime"
|
||||
)
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *Event) DeepCopyInto(out *Event) {
|
||||
*out = *in
|
||||
out.TypeMeta = in.TypeMeta
|
||||
in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
|
||||
in.Timestamp.DeepCopyInto(&out.Timestamp)
|
||||
in.User.DeepCopyInto(&out.User)
|
||||
if in.ImpersonatedUser != nil {
|
||||
in, out := &in.ImpersonatedUser, &out.ImpersonatedUser
|
||||
*out = new(v1.UserInfo)
|
||||
(*in).DeepCopyInto(*out)
|
||||
}
|
||||
if in.SourceIPs != nil {
|
||||
in, out := &in.SourceIPs, &out.SourceIPs
|
||||
*out = make([]string, len(*in))
|
||||
copy(*out, *in)
|
||||
}
|
||||
if in.ObjectRef != nil {
|
||||
in, out := &in.ObjectRef, &out.ObjectRef
|
||||
*out = new(ObjectReference)
|
||||
**out = **in
|
||||
}
|
||||
if in.ResponseStatus != nil {
|
||||
in, out := &in.ResponseStatus, &out.ResponseStatus
|
||||
*out = new(metav1.Status)
|
||||
(*in).DeepCopyInto(*out)
|
||||
}
|
||||
if in.RequestObject != nil {
|
||||
in, out := &in.RequestObject, &out.RequestObject
|
||||
*out = new(runtime.Unknown)
|
||||
(*in).DeepCopyInto(*out)
|
||||
}
|
||||
if in.ResponseObject != nil {
|
||||
in, out := &in.ResponseObject, &out.ResponseObject
|
||||
*out = new(runtime.Unknown)
|
||||
(*in).DeepCopyInto(*out)
|
||||
}
|
||||
in.RequestReceivedTimestamp.DeepCopyInto(&out.RequestReceivedTimestamp)
|
||||
in.StageTimestamp.DeepCopyInto(&out.StageTimestamp)
|
||||
if in.Annotations != nil {
|
||||
in, out := &in.Annotations, &out.Annotations
|
||||
*out = make(map[string]string, len(*in))
|
||||
for key, val := range *in {
|
||||
(*out)[key] = val
|
||||
}
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Event.
|
||||
func (in *Event) DeepCopy() *Event {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(Event)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
|
||||
func (in *Event) DeepCopyObject() runtime.Object {
|
||||
if c := in.DeepCopy(); c != nil {
|
||||
return c
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *EventList) DeepCopyInto(out *EventList) {
|
||||
*out = *in
|
||||
out.TypeMeta = in.TypeMeta
|
||||
in.ListMeta.DeepCopyInto(&out.ListMeta)
|
||||
if in.Items != nil {
|
||||
in, out := &in.Items, &out.Items
|
||||
*out = make([]Event, len(*in))
|
||||
for i := range *in {
|
||||
(*in)[i].DeepCopyInto(&(*out)[i])
|
||||
}
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EventList.
|
||||
func (in *EventList) DeepCopy() *EventList {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(EventList)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
|
||||
func (in *EventList) DeepCopyObject() runtime.Object {
|
||||
if c := in.DeepCopy(); c != nil {
|
||||
return c
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *GroupResources) DeepCopyInto(out *GroupResources) {
|
||||
*out = *in
|
||||
if in.Resources != nil {
|
||||
in, out := &in.Resources, &out.Resources
|
||||
*out = make([]string, len(*in))
|
||||
copy(*out, *in)
|
||||
}
|
||||
if in.ResourceNames != nil {
|
||||
in, out := &in.ResourceNames, &out.ResourceNames
|
||||
*out = make([]string, len(*in))
|
||||
copy(*out, *in)
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GroupResources.
|
||||
func (in *GroupResources) DeepCopy() *GroupResources {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(GroupResources)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *ObjectReference) DeepCopyInto(out *ObjectReference) {
|
||||
*out = *in
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ObjectReference.
|
||||
func (in *ObjectReference) DeepCopy() *ObjectReference {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(ObjectReference)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *Policy) DeepCopyInto(out *Policy) {
|
||||
*out = *in
|
||||
out.TypeMeta = in.TypeMeta
|
||||
in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
|
||||
if in.Rules != nil {
|
||||
in, out := &in.Rules, &out.Rules
|
||||
*out = make([]PolicyRule, len(*in))
|
||||
for i := range *in {
|
||||
(*in)[i].DeepCopyInto(&(*out)[i])
|
||||
}
|
||||
}
|
||||
if in.OmitStages != nil {
|
||||
in, out := &in.OmitStages, &out.OmitStages
|
||||
*out = make([]Stage, len(*in))
|
||||
copy(*out, *in)
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Policy.
|
||||
func (in *Policy) DeepCopy() *Policy {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(Policy)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
|
||||
func (in *Policy) DeepCopyObject() runtime.Object {
|
||||
if c := in.DeepCopy(); c != nil {
|
||||
return c
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *PolicyList) DeepCopyInto(out *PolicyList) {
|
||||
*out = *in
|
||||
out.TypeMeta = in.TypeMeta
|
||||
in.ListMeta.DeepCopyInto(&out.ListMeta)
|
||||
if in.Items != nil {
|
||||
in, out := &in.Items, &out.Items
|
||||
*out = make([]Policy, len(*in))
|
||||
for i := range *in {
|
||||
(*in)[i].DeepCopyInto(&(*out)[i])
|
||||
}
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PolicyList.
|
||||
func (in *PolicyList) DeepCopy() *PolicyList {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(PolicyList)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
|
||||
func (in *PolicyList) DeepCopyObject() runtime.Object {
|
||||
if c := in.DeepCopy(); c != nil {
|
||||
return c
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *PolicyRule) DeepCopyInto(out *PolicyRule) {
|
||||
*out = *in
|
||||
if in.Users != nil {
|
||||
in, out := &in.Users, &out.Users
|
||||
*out = make([]string, len(*in))
|
||||
copy(*out, *in)
|
||||
}
|
||||
if in.UserGroups != nil {
|
||||
in, out := &in.UserGroups, &out.UserGroups
|
||||
*out = make([]string, len(*in))
|
||||
copy(*out, *in)
|
||||
}
|
||||
if in.Verbs != nil {
|
||||
in, out := &in.Verbs, &out.Verbs
|
||||
*out = make([]string, len(*in))
|
||||
copy(*out, *in)
|
||||
}
|
||||
if in.Resources != nil {
|
||||
in, out := &in.Resources, &out.Resources
|
||||
*out = make([]GroupResources, len(*in))
|
||||
for i := range *in {
|
||||
(*in)[i].DeepCopyInto(&(*out)[i])
|
||||
}
|
||||
}
|
||||
if in.Namespaces != nil {
|
||||
in, out := &in.Namespaces, &out.Namespaces
|
||||
*out = make([]string, len(*in))
|
||||
copy(*out, *in)
|
||||
}
|
||||
if in.NonResourceURLs != nil {
|
||||
in, out := &in.NonResourceURLs, &out.NonResourceURLs
|
||||
*out = make([]string, len(*in))
|
||||
copy(*out, *in)
|
||||
}
|
||||
if in.OmitStages != nil {
|
||||
in, out := &in.OmitStages, &out.OmitStages
|
||||
*out = make([]Stage, len(*in))
|
||||
copy(*out, *in)
|
||||
}
|
||||
if in.OmitManagedFields != nil {
|
||||
in, out := &in.OmitManagedFields, &out.OmitManagedFields
|
||||
*out = new(bool)
|
||||
**out = **in
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PolicyRule.
|
||||
func (in *PolicyRule) DeepCopy() *PolicyRule {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(PolicyRule)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
@ -1,33 +0,0 @@
|
||||
//go:build !ignore_autogenerated
|
||||
// +build !ignore_autogenerated
|
||||
|
||||
/*
|
||||
Copyright The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
// Code generated by defaulter-gen. DO NOT EDIT.
|
||||
|
||||
package v1alpha1
|
||||
|
||||
import (
|
||||
runtime "k8s.io/apimachinery/pkg/runtime"
|
||||
)
|
||||
|
||||
// RegisterDefaults adds defaulters functions to the given scheme.
|
||||
// Public to allow building arbitrary schemes.
|
||||
// All generated defaulters are covering - they call all nested defaulters.
|
||||
func RegisterDefaults(scheme *runtime.Scheme) error {
|
||||
return nil
|
||||
}
|
||||
@ -1,122 +0,0 @@
|
||||
//go:build !ignore_autogenerated
|
||||
// +build !ignore_autogenerated
|
||||
|
||||
/*
|
||||
Copyright The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
// Code generated by prerelease-lifecycle-gen. DO NOT EDIT.
|
||||
|
||||
package v1alpha1
|
||||
|
||||
import (
|
||||
schema "k8s.io/apimachinery/pkg/runtime/schema"
|
||||
)
|
||||
|
||||
// APILifecycleIntroduced is an autogenerated function, returning the release in which the API struct was introduced as int versions of major and minor for comparison.
|
||||
// It is controlled by "k8s:prerelease-lifecycle-gen:introduced" tags in types.go.
|
||||
func (in *Event) APILifecycleIntroduced() (major, minor int) {
|
||||
return 1, 7
|
||||
}
|
||||
|
||||
// APILifecycleDeprecated is an autogenerated function, returning the release in which the API struct was or will be deprecated as int versions of major and minor for comparison.
|
||||
// It is controlled by "k8s:prerelease-lifecycle-gen:deprecated" tags in types.go or "k8s:prerelease-lifecycle-gen:introduced" plus three minor.
|
||||
func (in *Event) APILifecycleDeprecated() (major, minor int) {
|
||||
return 1, 21
|
||||
}
|
||||
|
||||
// APILifecycleReplacement is an autogenerated function, returning the group, version, and kind that should be used instead of this deprecated type.
|
||||
// It is controlled by "k8s:prerelease-lifecycle-gen:replacement=<group>,<version>,<kind>" tags in types.go.
|
||||
func (in *Event) APILifecycleReplacement() schema.GroupVersionKind {
|
||||
return schema.GroupVersionKind{Group: "audit.k8s.io", Version: "v1", Kind: "Event"}
|
||||
}
|
||||
|
||||
// APILifecycleRemoved is an autogenerated function, returning the release in which the API is no longer served as int versions of major and minor for comparison.
|
||||
// It is controlled by "k8s:prerelease-lifecycle-gen:removed" tags in types.go or "k8s:prerelease-lifecycle-gen:deprecated" plus three minor.
|
||||
func (in *Event) APILifecycleRemoved() (major, minor int) {
|
||||
return 1, 24
|
||||
}
|
||||
|
||||
// APILifecycleIntroduced is an autogenerated function, returning the release in which the API struct was introduced as int versions of major and minor for comparison.
|
||||
// It is controlled by "k8s:prerelease-lifecycle-gen:introduced" tags in types.go.
|
||||
func (in *EventList) APILifecycleIntroduced() (major, minor int) {
|
||||
return 1, 7
|
||||
}
|
||||
|
||||
// APILifecycleDeprecated is an autogenerated function, returning the release in which the API struct was or will be deprecated as int versions of major and minor for comparison.
|
||||
// It is controlled by "k8s:prerelease-lifecycle-gen:deprecated" tags in types.go or "k8s:prerelease-lifecycle-gen:introduced" plus three minor.
|
||||
func (in *EventList) APILifecycleDeprecated() (major, minor int) {
|
||||
return 1, 21
|
||||
}
|
||||
|
||||
// APILifecycleReplacement is an autogenerated function, returning the group, version, and kind that should be used instead of this deprecated type.
|
||||
// It is controlled by "k8s:prerelease-lifecycle-gen:replacement=<group>,<version>,<kind>" tags in types.go.
|
||||
func (in *EventList) APILifecycleReplacement() schema.GroupVersionKind {
|
||||
return schema.GroupVersionKind{Group: "audit.k8s.io", Version: "v1", Kind: "EventList"}
|
||||
}
|
||||
|
||||
// APILifecycleRemoved is an autogenerated function, returning the release in which the API is no longer served as int versions of major and minor for comparison.
|
||||
// It is controlled by "k8s:prerelease-lifecycle-gen:removed" tags in types.go or "k8s:prerelease-lifecycle-gen:deprecated" plus three minor.
|
||||
func (in *EventList) APILifecycleRemoved() (major, minor int) {
|
||||
return 1, 24
|
||||
}
|
||||
|
||||
// APILifecycleIntroduced is an autogenerated function, returning the release in which the API struct was introduced as int versions of major and minor for comparison.
|
||||
// It is controlled by "k8s:prerelease-lifecycle-gen:introduced" tags in types.go.
|
||||
func (in *Policy) APILifecycleIntroduced() (major, minor int) {
|
||||
return 1, 7
|
||||
}
|
||||
|
||||
// APILifecycleDeprecated is an autogenerated function, returning the release in which the API struct was or will be deprecated as int versions of major and minor for comparison.
|
||||
// It is controlled by "k8s:prerelease-lifecycle-gen:deprecated" tags in types.go or "k8s:prerelease-lifecycle-gen:introduced" plus three minor.
|
||||
func (in *Policy) APILifecycleDeprecated() (major, minor int) {
|
||||
return 1, 21
|
||||
}
|
||||
|
||||
// APILifecycleReplacement is an autogenerated function, returning the group, version, and kind that should be used instead of this deprecated type.
|
||||
// It is controlled by "k8s:prerelease-lifecycle-gen:replacement=<group>,<version>,<kind>" tags in types.go.
|
||||
func (in *Policy) APILifecycleReplacement() schema.GroupVersionKind {
|
||||
return schema.GroupVersionKind{Group: "audit.k8s.io", Version: "v1", Kind: "Policy"}
|
||||
}
|
||||
|
||||
// APILifecycleRemoved is an autogenerated function, returning the release in which the API is no longer served as int versions of major and minor for comparison.
|
||||
// It is controlled by "k8s:prerelease-lifecycle-gen:removed" tags in types.go or "k8s:prerelease-lifecycle-gen:deprecated" plus three minor.
|
||||
func (in *Policy) APILifecycleRemoved() (major, minor int) {
|
||||
return 1, 24
|
||||
}
|
||||
|
||||
// APILifecycleIntroduced is an autogenerated function, returning the release in which the API struct was introduced as int versions of major and minor for comparison.
|
||||
// It is controlled by "k8s:prerelease-lifecycle-gen:introduced" tags in types.go.
|
||||
func (in *PolicyList) APILifecycleIntroduced() (major, minor int) {
|
||||
return 1, 7
|
||||
}
|
||||
|
||||
// APILifecycleDeprecated is an autogenerated function, returning the release in which the API struct was or will be deprecated as int versions of major and minor for comparison.
|
||||
// It is controlled by "k8s:prerelease-lifecycle-gen:deprecated" tags in types.go or "k8s:prerelease-lifecycle-gen:introduced" plus three minor.
|
||||
func (in *PolicyList) APILifecycleDeprecated() (major, minor int) {
|
||||
return 1, 21
|
||||
}
|
||||
|
||||
// APILifecycleReplacement is an autogenerated function, returning the group, version, and kind that should be used instead of this deprecated type.
|
||||
// It is controlled by "k8s:prerelease-lifecycle-gen:replacement=<group>,<version>,<kind>" tags in types.go.
|
||||
func (in *PolicyList) APILifecycleReplacement() schema.GroupVersionKind {
|
||||
return schema.GroupVersionKind{Group: "audit.k8s.io", Version: "v1", Kind: "PolicyList"}
|
||||
}
|
||||
|
||||
// APILifecycleRemoved is an autogenerated function, returning the release in which the API is no longer served as int versions of major and minor for comparison.
|
||||
// It is controlled by "k8s:prerelease-lifecycle-gen:removed" tags in types.go or "k8s:prerelease-lifecycle-gen:deprecated" plus three minor.
|
||||
func (in *PolicyList) APILifecycleRemoved() (major, minor int) {
|
||||
return 1, 24
|
||||
}
|
||||
@ -1,45 +0,0 @@
|
||||
/*
|
||||
Copyright 2017 The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package v1beta1
|
||||
|
||||
import (
|
||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
"k8s.io/apimachinery/pkg/conversion"
|
||||
"k8s.io/apiserver/pkg/apis/audit"
|
||||
)
|
||||
|
||||
func Convert_v1beta1_Event_To_audit_Event(in *Event, out *audit.Event, s conversion.Scope) error {
|
||||
if err := autoConvert_v1beta1_Event_To_audit_Event(in, out, s); err != nil {
|
||||
return err
|
||||
}
|
||||
if out.StageTimestamp.IsZero() {
|
||||
out.StageTimestamp = metav1.NewMicroTime(in.CreationTimestamp.Time)
|
||||
}
|
||||
if out.RequestReceivedTimestamp.IsZero() {
|
||||
out.RequestReceivedTimestamp = metav1.NewMicroTime(in.Timestamp.Time)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func Convert_audit_Event_To_v1beta1_Event(in *audit.Event, out *Event, s conversion.Scope) error {
|
||||
if err := autoConvert_audit_Event_To_v1beta1_Event(in, out, s); err != nil {
|
||||
return err
|
||||
}
|
||||
out.CreationTimestamp = metav1.NewTime(in.StageTimestamp.Time)
|
||||
out.Timestamp = metav1.NewTime(in.RequestReceivedTimestamp.Time)
|
||||
return nil
|
||||
}
|
||||
@ -1,146 +0,0 @@
|
||||
/*
|
||||
Copyright 2017 The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package v1beta1
|
||||
|
||||
import (
|
||||
"reflect"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
"k8s.io/apimachinery/pkg/runtime"
|
||||
"k8s.io/apimachinery/pkg/runtime/schema"
|
||||
auditinternal "k8s.io/apiserver/pkg/apis/audit"
|
||||
)
|
||||
|
||||
var scheme = runtime.NewScheme()
|
||||
|
||||
func init() {
|
||||
addKnownTypes(scheme)
|
||||
internalGV := schema.GroupVersion{Group: auditinternal.GroupName, Version: runtime.APIVersionInternal}
|
||||
scheme.AddKnownTypes(internalGV,
|
||||
&auditinternal.Event{},
|
||||
)
|
||||
RegisterConversions(scheme)
|
||||
}
|
||||
|
||||
func TestConversionEventToInternal(t *testing.T) {
|
||||
time1 := time.Now()
|
||||
time2 := time.Now()
|
||||
testcases := []struct {
|
||||
desc string
|
||||
old *Event
|
||||
expected *auditinternal.Event
|
||||
}{
|
||||
{
|
||||
"StageTimestamp is empty",
|
||||
&Event{
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
CreationTimestamp: metav1.NewTime(time1),
|
||||
},
|
||||
},
|
||||
&auditinternal.Event{
|
||||
StageTimestamp: metav1.NewMicroTime(time1),
|
||||
},
|
||||
},
|
||||
{
|
||||
"StageTimestamp is not empty",
|
||||
&Event{
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
CreationTimestamp: metav1.NewTime(time1),
|
||||
},
|
||||
StageTimestamp: metav1.NewMicroTime(time2),
|
||||
},
|
||||
&auditinternal.Event{
|
||||
StageTimestamp: metav1.NewMicroTime(time2),
|
||||
},
|
||||
},
|
||||
{
|
||||
"RequestReceivedTimestamp is empty",
|
||||
&Event{
|
||||
Timestamp: metav1.NewTime(time1),
|
||||
},
|
||||
&auditinternal.Event{
|
||||
RequestReceivedTimestamp: metav1.NewMicroTime(time1),
|
||||
},
|
||||
},
|
||||
{
|
||||
"RequestReceivedTimestamp is not empty",
|
||||
&Event{
|
||||
Timestamp: metav1.NewTime(time1),
|
||||
RequestReceivedTimestamp: metav1.NewMicroTime(time2),
|
||||
},
|
||||
&auditinternal.Event{
|
||||
RequestReceivedTimestamp: metav1.NewMicroTime(time2),
|
||||
},
|
||||
},
|
||||
}
|
||||
for _, tc := range testcases {
|
||||
t.Run(tc.desc, func(t *testing.T) {
|
||||
internal := &auditinternal.Event{}
|
||||
if err := scheme.Convert(tc.old, internal, nil); err != nil {
|
||||
t.Errorf("unexpected error: %v", err)
|
||||
}
|
||||
if !reflect.DeepEqual(internal, tc.expected) {
|
||||
t.Errorf("expected\n\t%#v, got \n\t%#v", tc.expected, internal)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestConversionInternalToEvent(t *testing.T) {
|
||||
now := time.Now()
|
||||
testcases := []struct {
|
||||
desc string
|
||||
old *auditinternal.Event
|
||||
expected *Event
|
||||
}{
|
||||
{
|
||||
"convert stageTimestamp",
|
||||
&auditinternal.Event{
|
||||
StageTimestamp: metav1.NewMicroTime(now),
|
||||
},
|
||||
&Event{
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
CreationTimestamp: metav1.NewTime(now),
|
||||
},
|
||||
StageTimestamp: metav1.NewMicroTime(now),
|
||||
},
|
||||
},
|
||||
{
|
||||
"convert RequestReceivedTimestamp",
|
||||
&auditinternal.Event{
|
||||
RequestReceivedTimestamp: metav1.NewMicroTime(now),
|
||||
},
|
||||
&Event{
|
||||
Timestamp: metav1.NewTime(now),
|
||||
RequestReceivedTimestamp: metav1.NewMicroTime(now),
|
||||
},
|
||||
},
|
||||
}
|
||||
for _, tc := range testcases {
|
||||
t.Run(tc.desc, func(t *testing.T) {
|
||||
event := &Event{}
|
||||
if err := scheme.Convert(tc.old, event, nil); err != nil {
|
||||
t.Errorf("unexpected error: %v", err)
|
||||
}
|
||||
if !reflect.DeepEqual(event, tc.expected) {
|
||||
t.Errorf("expected\n\t%#v, got \n\t%#v", tc.expected, event)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
@ -1,26 +0,0 @@
|
||||
/*
|
||||
Copyright 2017 The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
// +k8s:deepcopy-gen=package
|
||||
// +k8s:protobuf-gen=package
|
||||
// +k8s:conversion-gen=k8s.io/apiserver/pkg/apis/audit
|
||||
// +k8s:openapi-gen=true
|
||||
// +k8s:prerelease-lifecycle-gen=true
|
||||
// +k8s:defaulter-gen=TypeMeta
|
||||
|
||||
// +groupName=audit.k8s.io
|
||||
|
||||
package v1beta1 // import "k8s.io/apiserver/pkg/apis/audit/v1beta1"
|
||||
File diff suppressed because it is too large
Load Diff
@ -1,283 +0,0 @@
|
||||
/*
|
||||
Copyright The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
|
||||
// This file was autogenerated by go-to-protobuf. Do not edit it manually!
|
||||
|
||||
syntax = "proto2";
|
||||
|
||||
package k8s.io.apiserver.pkg.apis.audit.v1beta1;
|
||||
|
||||
import "k8s.io/api/authentication/v1/generated.proto";
|
||||
import "k8s.io/apimachinery/pkg/apis/meta/v1/generated.proto";
|
||||
import "k8s.io/apimachinery/pkg/runtime/generated.proto";
|
||||
import "k8s.io/apimachinery/pkg/runtime/schema/generated.proto";
|
||||
|
||||
// Package-wide variables from generator "generated".
|
||||
option go_package = "k8s.io/apiserver/pkg/apis/audit/v1beta1";
|
||||
|
||||
// DEPRECATED - This group version of Event is deprecated by audit.k8s.io/v1/Event. See the release notes for
|
||||
// more information.
|
||||
// Event captures all the information that can be included in an API audit log.
|
||||
message Event {
|
||||
// ObjectMeta is included for interoperability with API infrastructure.
|
||||
// +optional
|
||||
// DEPRECATED: Use StageTimestamp which supports micro second instead of ObjectMeta.CreateTimestamp
|
||||
// and the rest of the object is not used
|
||||
optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
|
||||
|
||||
// AuditLevel at which event was generated
|
||||
optional string level = 2;
|
||||
|
||||
// Time the request reached the apiserver.
|
||||
// DEPRECATED: Use RequestReceivedTimestamp which supports micro second instead.
|
||||
optional k8s.io.apimachinery.pkg.apis.meta.v1.Time timestamp = 3;
|
||||
|
||||
// Unique audit ID, generated for each request.
|
||||
optional string auditID = 4;
|
||||
|
||||
// Stage of the request handling when this event instance was generated.
|
||||
optional string stage = 5;
|
||||
|
||||
// RequestURI is the request URI as sent by the client to a server.
|
||||
optional string requestURI = 6;
|
||||
|
||||
// Verb is the kubernetes verb associated with the request.
|
||||
// For non-resource requests, this is the lower-cased HTTP method.
|
||||
optional string verb = 7;
|
||||
|
||||
// Authenticated user information.
|
||||
optional k8s.io.api.authentication.v1.UserInfo user = 8;
|
||||
|
||||
// Impersonated user information.
|
||||
// +optional
|
||||
optional k8s.io.api.authentication.v1.UserInfo impersonatedUser = 9;
|
||||
|
||||
// Source IPs, from where the request originated and intermediate proxies.
|
||||
// +optional
|
||||
repeated string sourceIPs = 10;
|
||||
|
||||
// UserAgent records the user agent string reported by the client.
|
||||
// Note that the UserAgent is provided by the client, and must not be trusted.
|
||||
// +optional
|
||||
optional string userAgent = 18;
|
||||
|
||||
// Object reference this request is targeted at.
|
||||
// Does not apply for List-type requests, or non-resource requests.
|
||||
// +optional
|
||||
optional ObjectReference objectRef = 11;
|
||||
|
||||
// The response status, populated even when the ResponseObject is not a Status type.
|
||||
// For successful responses, this will only include the Code and StatusSuccess.
|
||||
// For non-status type error responses, this will be auto-populated with the error Message.
|
||||
// +optional
|
||||
optional k8s.io.apimachinery.pkg.apis.meta.v1.Status responseStatus = 12;
|
||||
|
||||
// API object from the request, in JSON format. The RequestObject is recorded as-is in the request
|
||||
// (possibly re-encoded as JSON), prior to version conversion, defaulting, admission or
|
||||
// merging. It is an external versioned object type, and may not be a valid object on its own.
|
||||
// Omitted for non-resource requests. Only logged at Request Level and higher.
|
||||
// +optional
|
||||
optional k8s.io.apimachinery.pkg.runtime.Unknown requestObject = 13;
|
||||
|
||||
// API object returned in the response, in JSON. The ResponseObject is recorded after conversion
|
||||
// to the external type, and serialized as JSON. Omitted for non-resource requests. Only logged
|
||||
// at Response Level.
|
||||
// +optional
|
||||
optional k8s.io.apimachinery.pkg.runtime.Unknown responseObject = 14;
|
||||
|
||||
// Time the request reached the apiserver.
|
||||
// +optional
|
||||
optional k8s.io.apimachinery.pkg.apis.meta.v1.MicroTime requestReceivedTimestamp = 15;
|
||||
|
||||
// Time the request reached current audit stage.
|
||||
// +optional
|
||||
optional k8s.io.apimachinery.pkg.apis.meta.v1.MicroTime stageTimestamp = 16;
|
||||
|
||||
// Annotations is an unstructured key value map stored with an audit event that may be set by
|
||||
// plugins invoked in the request serving chain, including authentication, authorization and
|
||||
// admission plugins. Note that these annotations are for the audit event, and do not correspond
|
||||
// to the metadata.annotations of the submitted object. Keys should uniquely identify the informing
|
||||
// component to avoid name collisions (e.g. podsecuritypolicy.admission.k8s.io/policy). Values
|
||||
// should be short. Annotations are included in the Metadata level.
|
||||
// +optional
|
||||
map<string, string> annotations = 17;
|
||||
}
|
||||
|
||||
// EventList is a list of audit Events.
|
||||
message EventList {
|
||||
// +optional
|
||||
optional k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;
|
||||
|
||||
repeated Event items = 2;
|
||||
}
|
||||
|
||||
// GroupResources represents resource kinds in an API group.
|
||||
message GroupResources {
|
||||
// Group is the name of the API group that contains the resources.
|
||||
// The empty string represents the core API group.
|
||||
// +optional
|
||||
optional string group = 1;
|
||||
|
||||
// Resources is a list of resources this rule applies to.
|
||||
//
|
||||
// For example:
|
||||
// 'pods' matches pods.
|
||||
// 'pods/log' matches the log subresource of pods.
|
||||
// '*' matches all resources and their subresources.
|
||||
// 'pods/*' matches all subresources of pods.
|
||||
// '*/scale' matches all scale subresources.
|
||||
//
|
||||
// If wildcard is present, the validation rule will ensure resources do not
|
||||
// overlap with each other.
|
||||
//
|
||||
// An empty list implies all resources and subresources in this API groups apply.
|
||||
// +optional
|
||||
repeated string resources = 2;
|
||||
|
||||
// ResourceNames is a list of resource instance names that the policy matches.
|
||||
// Using this field requires Resources to be specified.
|
||||
// An empty list implies that every instance of the resource is matched.
|
||||
// +optional
|
||||
repeated string resourceNames = 3;
|
||||
}
|
||||
|
||||
// ObjectReference contains enough information to let you inspect or modify the referred object.
|
||||
message ObjectReference {
|
||||
// +optional
|
||||
optional string resource = 1;
|
||||
|
||||
// +optional
|
||||
optional string namespace = 2;
|
||||
|
||||
// +optional
|
||||
optional string name = 3;
|
||||
|
||||
// +optional
|
||||
optional string uid = 4;
|
||||
|
||||
// APIGroup is the name of the API group that contains the referred object.
|
||||
// The empty string represents the core API group.
|
||||
// +optional
|
||||
optional string apiGroup = 5;
|
||||
|
||||
// APIVersion is the version of the API group that contains the referred object.
|
||||
// +optional
|
||||
optional string apiVersion = 6;
|
||||
|
||||
// +optional
|
||||
optional string resourceVersion = 7;
|
||||
|
||||
// +optional
|
||||
optional string subresource = 8;
|
||||
}
|
||||
|
||||
// DEPRECATED - This group version of Policy is deprecated by audit.k8s.io/v1/Policy. See the release notes for
|
||||
// more information.
|
||||
// Policy defines the configuration of audit logging, and the rules for how different request
|
||||
// categories are logged.
|
||||
message Policy {
|
||||
// ObjectMeta is included for interoperability with API infrastructure.
|
||||
// +optional
|
||||
optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
|
||||
|
||||
// Rules specify the audit Level a request should be recorded at.
|
||||
// A request may match multiple rules, in which case the FIRST matching rule is used.
|
||||
// The default audit level is None, but can be overridden by a catch-all rule at the end of the list.
|
||||
// PolicyRules are strictly ordered.
|
||||
repeated PolicyRule rules = 2;
|
||||
|
||||
// OmitStages is a list of stages for which no events are created. Note that this can also
|
||||
// be specified per rule in which case the union of both are omitted.
|
||||
// +optional
|
||||
repeated string omitStages = 3;
|
||||
|
||||
// OmitManagedFields indicates whether to omit the managed fields of the request
|
||||
// and response bodies from being written to the API audit log.
|
||||
// This is used as a global default - a value of 'true' will omit the managed fileds,
|
||||
// otherwise the managed fields will be included in the API audit log.
|
||||
// Note that this can also be specified per rule in which case the value specified
|
||||
// in a rule will override the global default.
|
||||
// +optional
|
||||
optional bool omitManagedFields = 4;
|
||||
}
|
||||
|
||||
// PolicyList is a list of audit Policies.
|
||||
message PolicyList {
|
||||
// +optional
|
||||
optional k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;
|
||||
|
||||
repeated Policy items = 2;
|
||||
}
|
||||
|
||||
// PolicyRule maps requests based off metadata to an audit Level.
|
||||
// Requests must match the rules of every field (an intersection of rules).
|
||||
message PolicyRule {
|
||||
// The Level that requests matching this rule are recorded at.
|
||||
optional string level = 1;
|
||||
|
||||
// The users (by authenticated user name) this rule applies to.
|
||||
// An empty list implies every user.
|
||||
// +optional
|
||||
repeated string users = 2;
|
||||
|
||||
// The user groups this rule applies to. A user is considered matching
|
||||
// if it is a member of any of the UserGroups.
|
||||
// An empty list implies every user group.
|
||||
// +optional
|
||||
repeated string userGroups = 3;
|
||||
|
||||
// The verbs that match this rule.
|
||||
// An empty list implies every verb.
|
||||
// +optional
|
||||
repeated string verbs = 4;
|
||||
|
||||
// Resources that this rule matches. An empty list implies all kinds in all API groups.
|
||||
// +optional
|
||||
repeated GroupResources resources = 5;
|
||||
|
||||
// Namespaces that this rule matches.
|
||||
// The empty string "" matches non-namespaced resources.
|
||||
// An empty list implies every namespace.
|
||||
// +optional
|
||||
repeated string namespaces = 6;
|
||||
|
||||
// NonResourceURLs is a set of URL paths that should be audited.
|
||||
// *s are allowed, but only as the full, final step in the path.
|
||||
// Examples:
|
||||
// "/metrics" - Log requests for apiserver metrics
|
||||
// "/healthz*" - Log all health checks
|
||||
// +optional
|
||||
repeated string nonResourceURLs = 7;
|
||||
|
||||
// OmitStages is a list of stages for which no events are created. Note that this can also
|
||||
// be specified policy wide in which case the union of both are omitted.
|
||||
// An empty list means no restrictions will apply.
|
||||
// +optional
|
||||
repeated string omitStages = 8;
|
||||
|
||||
// OmitManagedFields indicates whether to omit the managed fields of the request
|
||||
// and response bodies from being written to the API audit log.
|
||||
// - a value of 'true' will drop the managed fields from the API audit log
|
||||
// - a value of 'false' indicates that the managed fileds should be included
|
||||
// in the API audit log
|
||||
// Note that the value, if specified, in this rule will override the global default
|
||||
// If a value is not specified then the global default specified in
|
||||
// Policy.OmitManagedFields will stand.
|
||||
// +optional
|
||||
optional bool omitManagedFields = 9;
|
||||
}
|
||||
|
||||
@ -1,58 +0,0 @@
|
||||
/*
|
||||
Copyright 2017 The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package v1beta1
|
||||
|
||||
import (
|
||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
"k8s.io/apimachinery/pkg/runtime"
|
||||
"k8s.io/apimachinery/pkg/runtime/schema"
|
||||
)
|
||||
|
||||
// GroupName is the group name use in this package
|
||||
const GroupName = "audit.k8s.io"
|
||||
|
||||
// SchemeGroupVersion is group version used to register these objects
|
||||
var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1beta1"}
|
||||
|
||||
// Resource takes an unqualified resource and returns a Group qualified GroupResource
|
||||
func Resource(resource string) schema.GroupResource {
|
||||
return SchemeGroupVersion.WithResource(resource).GroupResource()
|
||||
}
|
||||
|
||||
var (
|
||||
SchemeBuilder runtime.SchemeBuilder
|
||||
localSchemeBuilder = &SchemeBuilder
|
||||
AddToScheme = localSchemeBuilder.AddToScheme
|
||||
)
|
||||
|
||||
func init() {
|
||||
// We only register manually written functions here. The registration of the
|
||||
// generated functions takes place in the generated files. The separation
|
||||
// makes the code compile even when the generated files are missing.
|
||||
localSchemeBuilder.Register(addKnownTypes)
|
||||
}
|
||||
|
||||
func addKnownTypes(scheme *runtime.Scheme) error {
|
||||
scheme.AddKnownTypes(SchemeGroupVersion,
|
||||
&Event{},
|
||||
&EventList{},
|
||||
&Policy{},
|
||||
&PolicyList{},
|
||||
)
|
||||
metav1.AddToGroupVersion(scheme, SchemeGroupVersion)
|
||||
return nil
|
||||
}
|
||||
@ -1,324 +0,0 @@
|
||||
/*
|
||||
Copyright 2017 The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package v1beta1
|
||||
|
||||
import (
|
||||
authnv1 "k8s.io/api/authentication/v1"
|
||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
"k8s.io/apimachinery/pkg/runtime"
|
||||
"k8s.io/apimachinery/pkg/types"
|
||||
)
|
||||
|
||||
// Header keys used by the audit system.
|
||||
const (
|
||||
// Header to hold the audit ID as the request is propagated through the serving hierarchy. The
|
||||
// Audit-ID header should be set by the first server to receive the request (e.g. the federation
|
||||
// server or kube-aggregator).
|
||||
HeaderAuditID = "Audit-ID"
|
||||
)
|
||||
|
||||
// Level defines the amount of information logged during auditing
|
||||
type Level string
|
||||
|
||||
// Valid audit levels
|
||||
const (
|
||||
// LevelNone disables auditing
|
||||
LevelNone Level = "None"
|
||||
// LevelMetadata provides the basic level of auditing.
|
||||
LevelMetadata Level = "Metadata"
|
||||
// LevelRequest provides Metadata level of auditing, and additionally
|
||||
// logs the request object (does not apply for non-resource requests).
|
||||
LevelRequest Level = "Request"
|
||||
// LevelRequestResponse provides Request level of auditing, and additionally
|
||||
// logs the response object (does not apply for non-resource requests).
|
||||
LevelRequestResponse Level = "RequestResponse"
|
||||
)
|
||||
|
||||
// Stage defines the stages in request handling that audit events may be generated.
|
||||
type Stage string
|
||||
|
||||
// Valid audit stages.
|
||||
const (
|
||||
// The stage for events generated as soon as the audit handler receives the request, and before it
|
||||
// is delegated down the handler chain.
|
||||
StageRequestReceived Stage = "RequestReceived"
|
||||
// The stage for events generated once the response headers are sent, but before the response body
|
||||
// is sent. This stage is only generated for long-running requests (e.g. watch).
|
||||
StageResponseStarted Stage = "ResponseStarted"
|
||||
// The stage for events generated once the response body has been completed, and no more bytes
|
||||
// will be sent.
|
||||
StageResponseComplete Stage = "ResponseComplete"
|
||||
// The stage for events generated when a panic occurred.
|
||||
StagePanic Stage = "Panic"
|
||||
)
|
||||
|
||||
// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
|
||||
// +k8s:prerelease-lifecycle-gen:introduced=1.8
|
||||
// +k8s:prerelease-lifecycle-gen:deprecated=1.21
|
||||
// +k8s:prerelease-lifecycle-gen:replacement=audit.k8s.io,v1,Event
|
||||
|
||||
// DEPRECATED - This group version of Event is deprecated by audit.k8s.io/v1/Event. See the release notes for
|
||||
// more information.
|
||||
// Event captures all the information that can be included in an API audit log.
|
||||
type Event struct {
|
||||
metav1.TypeMeta `json:",inline"`
|
||||
// ObjectMeta is included for interoperability with API infrastructure.
|
||||
// +optional
|
||||
// DEPRECATED: Use StageTimestamp which supports micro second instead of ObjectMeta.CreateTimestamp
|
||||
// and the rest of the object is not used
|
||||
metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
|
||||
|
||||
// AuditLevel at which event was generated
|
||||
Level Level `json:"level" protobuf:"bytes,2,opt,name=level,casttype=Level"`
|
||||
|
||||
// Time the request reached the apiserver.
|
||||
// DEPRECATED: Use RequestReceivedTimestamp which supports micro second instead.
|
||||
Timestamp metav1.Time `json:"timestamp" protobuf:"bytes,3,opt,name=timestamp"`
|
||||
// Unique audit ID, generated for each request.
|
||||
AuditID types.UID `json:"auditID" protobuf:"bytes,4,opt,name=auditID,casttype=k8s.io/apimachinery/pkg/types.UID"`
|
||||
// Stage of the request handling when this event instance was generated.
|
||||
Stage Stage `json:"stage" protobuf:"bytes,5,opt,name=stage,casttype=Stage"`
|
||||
|
||||
// RequestURI is the request URI as sent by the client to a server.
|
||||
RequestURI string `json:"requestURI" protobuf:"bytes,6,opt,name=requestURI"`
|
||||
// Verb is the kubernetes verb associated with the request.
|
||||
// For non-resource requests, this is the lower-cased HTTP method.
|
||||
Verb string `json:"verb" protobuf:"bytes,7,opt,name=verb"`
|
||||
// Authenticated user information.
|
||||
User authnv1.UserInfo `json:"user" protobuf:"bytes,8,opt,name=user"`
|
||||
// Impersonated user information.
|
||||
// +optional
|
||||
ImpersonatedUser *authnv1.UserInfo `json:"impersonatedUser,omitempty" protobuf:"bytes,9,opt,name=impersonatedUser"`
|
||||
// Source IPs, from where the request originated and intermediate proxies.
|
||||
// +optional
|
||||
SourceIPs []string `json:"sourceIPs,omitempty" protobuf:"bytes,10,rep,name=sourceIPs"`
|
||||
// UserAgent records the user agent string reported by the client.
|
||||
// Note that the UserAgent is provided by the client, and must not be trusted.
|
||||
// +optional
|
||||
UserAgent string `json:"userAgent,omitempty" protobuf:"bytes,18,opt,name=userAgent"`
|
||||
// Object reference this request is targeted at.
|
||||
// Does not apply for List-type requests, or non-resource requests.
|
||||
// +optional
|
||||
ObjectRef *ObjectReference `json:"objectRef,omitempty" protobuf:"bytes,11,opt,name=objectRef"`
|
||||
// The response status, populated even when the ResponseObject is not a Status type.
|
||||
// For successful responses, this will only include the Code and StatusSuccess.
|
||||
// For non-status type error responses, this will be auto-populated with the error Message.
|
||||
// +optional
|
||||
ResponseStatus *metav1.Status `json:"responseStatus,omitempty" protobuf:"bytes,12,opt,name=responseStatus"`
|
||||
|
||||
// API object from the request, in JSON format. The RequestObject is recorded as-is in the request
|
||||
// (possibly re-encoded as JSON), prior to version conversion, defaulting, admission or
|
||||
// merging. It is an external versioned object type, and may not be a valid object on its own.
|
||||
// Omitted for non-resource requests. Only logged at Request Level and higher.
|
||||
// +optional
|
||||
RequestObject *runtime.Unknown `json:"requestObject,omitempty" protobuf:"bytes,13,opt,name=requestObject"`
|
||||
// API object returned in the response, in JSON. The ResponseObject is recorded after conversion
|
||||
// to the external type, and serialized as JSON. Omitted for non-resource requests. Only logged
|
||||
// at Response Level.
|
||||
// +optional
|
||||
ResponseObject *runtime.Unknown `json:"responseObject,omitempty" protobuf:"bytes,14,opt,name=responseObject"`
|
||||
// Time the request reached the apiserver.
|
||||
// +optional
|
||||
RequestReceivedTimestamp metav1.MicroTime `json:"requestReceivedTimestamp" protobuf:"bytes,15,opt,name=requestReceivedTimestamp"`
|
||||
// Time the request reached current audit stage.
|
||||
// +optional
|
||||
StageTimestamp metav1.MicroTime `json:"stageTimestamp" protobuf:"bytes,16,opt,name=stageTimestamp"`
|
||||
|
||||
// Annotations is an unstructured key value map stored with an audit event that may be set by
|
||||
// plugins invoked in the request serving chain, including authentication, authorization and
|
||||
// admission plugins. Note that these annotations are for the audit event, and do not correspond
|
||||
// to the metadata.annotations of the submitted object. Keys should uniquely identify the informing
|
||||
// component to avoid name collisions (e.g. podsecuritypolicy.admission.k8s.io/policy). Values
|
||||
// should be short. Annotations are included in the Metadata level.
|
||||
// +optional
|
||||
Annotations map[string]string `json:"annotations,omitempty" protobuf:"bytes,17,rep,name=annotations"`
|
||||
}
|
||||
|
||||
// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
|
||||
// +k8s:prerelease-lifecycle-gen:introduced=1.8
|
||||
// +k8s:prerelease-lifecycle-gen:deprecated=1.21
|
||||
// +k8s:prerelease-lifecycle-gen:replacement=audit.k8s.io,v1,EventList
|
||||
|
||||
// EventList is a list of audit Events.
|
||||
type EventList struct {
|
||||
metav1.TypeMeta `json:",inline"`
|
||||
// +optional
|
||||
metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
|
||||
|
||||
Items []Event `json:"items" protobuf:"bytes,2,rep,name=items"`
|
||||
}
|
||||
|
||||
// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
|
||||
// +k8s:prerelease-lifecycle-gen:introduced=1.8
|
||||
// +k8s:prerelease-lifecycle-gen:deprecated=1.21
|
||||
// +k8s:prerelease-lifecycle-gen:replacement=audit.k8s.io,v1,Policy
|
||||
|
||||
// DEPRECATED - This group version of Policy is deprecated by audit.k8s.io/v1/Policy. See the release notes for
|
||||
// more information.
|
||||
// Policy defines the configuration of audit logging, and the rules for how different request
|
||||
// categories are logged.
|
||||
type Policy struct {
|
||||
metav1.TypeMeta `json:",inline"`
|
||||
// ObjectMeta is included for interoperability with API infrastructure.
|
||||
// +optional
|
||||
metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
|
||||
|
||||
// Rules specify the audit Level a request should be recorded at.
|
||||
// A request may match multiple rules, in which case the FIRST matching rule is used.
|
||||
// The default audit level is None, but can be overridden by a catch-all rule at the end of the list.
|
||||
// PolicyRules are strictly ordered.
|
||||
Rules []PolicyRule `json:"rules" protobuf:"bytes,2,rep,name=rules"`
|
||||
|
||||
// OmitStages is a list of stages for which no events are created. Note that this can also
|
||||
// be specified per rule in which case the union of both are omitted.
|
||||
// +optional
|
||||
OmitStages []Stage `json:"omitStages,omitempty" protobuf:"bytes,3,rep,name=omitStages"`
|
||||
|
||||
// OmitManagedFields indicates whether to omit the managed fields of the request
|
||||
// and response bodies from being written to the API audit log.
|
||||
// This is used as a global default - a value of 'true' will omit the managed fileds,
|
||||
// otherwise the managed fields will be included in the API audit log.
|
||||
// Note that this can also be specified per rule in which case the value specified
|
||||
// in a rule will override the global default.
|
||||
// +optional
|
||||
OmitManagedFields bool `json:"omitManagedFields,omitempty" protobuf:"varint,4,opt,name=omitManagedFields"`
|
||||
}
|
||||
|
||||
// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
|
||||
// +k8s:prerelease-lifecycle-gen:introduced=1.8
|
||||
// +k8s:prerelease-lifecycle-gen:deprecated=1.21
|
||||
// +k8s:prerelease-lifecycle-gen:replacement=audit.k8s.io,v1,PolicyList
|
||||
|
||||
// PolicyList is a list of audit Policies.
|
||||
type PolicyList struct {
|
||||
metav1.TypeMeta `json:",inline"`
|
||||
// +optional
|
||||
metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
|
||||
|
||||
Items []Policy `json:"items" protobuf:"bytes,2,rep,name=items"`
|
||||
}
|
||||
|
||||
// PolicyRule maps requests based off metadata to an audit Level.
|
||||
// Requests must match the rules of every field (an intersection of rules).
|
||||
type PolicyRule struct {
|
||||
// The Level that requests matching this rule are recorded at.
|
||||
Level Level `json:"level" protobuf:"bytes,1,opt,name=level,casttype=Level"`
|
||||
|
||||
// The users (by authenticated user name) this rule applies to.
|
||||
// An empty list implies every user.
|
||||
// +optional
|
||||
Users []string `json:"users,omitempty" protobuf:"bytes,2,rep,name=users"`
|
||||
// The user groups this rule applies to. A user is considered matching
|
||||
// if it is a member of any of the UserGroups.
|
||||
// An empty list implies every user group.
|
||||
// +optional
|
||||
UserGroups []string `json:"userGroups,omitempty" protobuf:"bytes,3,rep,name=userGroups"`
|
||||
|
||||
// The verbs that match this rule.
|
||||
// An empty list implies every verb.
|
||||
// +optional
|
||||
Verbs []string `json:"verbs,omitempty" protobuf:"bytes,4,rep,name=verbs"`
|
||||
|
||||
// Rules can apply to API resources (such as "pods" or "secrets"),
|
||||
// non-resource URL paths (such as "/api"), or neither, but not both.
|
||||
// If neither is specified, the rule is treated as a default for all URLs.
|
||||
|
||||
// Resources that this rule matches. An empty list implies all kinds in all API groups.
|
||||
// +optional
|
||||
Resources []GroupResources `json:"resources,omitempty" protobuf:"bytes,5,rep,name=resources"`
|
||||
// Namespaces that this rule matches.
|
||||
// The empty string "" matches non-namespaced resources.
|
||||
// An empty list implies every namespace.
|
||||
// +optional
|
||||
Namespaces []string `json:"namespaces,omitempty" protobuf:"bytes,6,rep,name=namespaces"`
|
||||
|
||||
// NonResourceURLs is a set of URL paths that should be audited.
|
||||
// *s are allowed, but only as the full, final step in the path.
|
||||
// Examples:
|
||||
// "/metrics" - Log requests for apiserver metrics
|
||||
// "/healthz*" - Log all health checks
|
||||
// +optional
|
||||
NonResourceURLs []string `json:"nonResourceURLs,omitempty" protobuf:"bytes,7,rep,name=nonResourceURLs"`
|
||||
|
||||
// OmitStages is a list of stages for which no events are created. Note that this can also
|
||||
// be specified policy wide in which case the union of both are omitted.
|
||||
// An empty list means no restrictions will apply.
|
||||
// +optional
|
||||
OmitStages []Stage `json:"omitStages,omitempty" protobuf:"bytes,8,rep,name=omitStages"`
|
||||
|
||||
// OmitManagedFields indicates whether to omit the managed fields of the request
|
||||
// and response bodies from being written to the API audit log.
|
||||
// - a value of 'true' will drop the managed fields from the API audit log
|
||||
// - a value of 'false' indicates that the managed fileds should be included
|
||||
// in the API audit log
|
||||
// Note that the value, if specified, in this rule will override the global default
|
||||
// If a value is not specified then the global default specified in
|
||||
// Policy.OmitManagedFields will stand.
|
||||
// +optional
|
||||
OmitManagedFields *bool `json:"omitManagedFields,omitempty" protobuf:"varint,9,opt,name=omitManagedFields"`
|
||||
}
|
||||
|
||||
// GroupResources represents resource kinds in an API group.
|
||||
type GroupResources struct {
|
||||
// Group is the name of the API group that contains the resources.
|
||||
// The empty string represents the core API group.
|
||||
// +optional
|
||||
Group string `json:"group,omitempty" protobuf:"bytes,1,opt,name=group"`
|
||||
// Resources is a list of resources this rule applies to.
|
||||
//
|
||||
// For example:
|
||||
// 'pods' matches pods.
|
||||
// 'pods/log' matches the log subresource of pods.
|
||||
// '*' matches all resources and their subresources.
|
||||
// 'pods/*' matches all subresources of pods.
|
||||
// '*/scale' matches all scale subresources.
|
||||
//
|
||||
// If wildcard is present, the validation rule will ensure resources do not
|
||||
// overlap with each other.
|
||||
//
|
||||
// An empty list implies all resources and subresources in this API groups apply.
|
||||
// +optional
|
||||
Resources []string `json:"resources,omitempty" protobuf:"bytes,2,rep,name=resources"`
|
||||
// ResourceNames is a list of resource instance names that the policy matches.
|
||||
// Using this field requires Resources to be specified.
|
||||
// An empty list implies that every instance of the resource is matched.
|
||||
// +optional
|
||||
ResourceNames []string `json:"resourceNames,omitempty" protobuf:"bytes,3,rep,name=resourceNames"`
|
||||
}
|
||||
|
||||
// ObjectReference contains enough information to let you inspect or modify the referred object.
|
||||
type ObjectReference struct {
|
||||
// +optional
|
||||
Resource string `json:"resource,omitempty" protobuf:"bytes,1,opt,name=resource"`
|
||||
// +optional
|
||||
Namespace string `json:"namespace,omitempty" protobuf:"bytes,2,opt,name=namespace"`
|
||||
// +optional
|
||||
Name string `json:"name,omitempty" protobuf:"bytes,3,opt,name=name"`
|
||||
// +optional
|
||||
UID types.UID `json:"uid,omitempty" protobuf:"bytes,4,opt,name=uid,casttype=k8s.io/apimachinery/pkg/types.UID"`
|
||||
// APIGroup is the name of the API group that contains the referred object.
|
||||
// The empty string represents the core API group.
|
||||
// +optional
|
||||
APIGroup string `json:"apiGroup,omitempty" protobuf:"bytes,5,opt,name=apiGroup"`
|
||||
// APIVersion is the version of the API group that contains the referred object.
|
||||
// +optional
|
||||
APIVersion string `json:"apiVersion,omitempty" protobuf:"bytes,6,opt,name=apiVersion"`
|
||||
// +optional
|
||||
ResourceVersion string `json:"resourceVersion,omitempty" protobuf:"bytes,7,opt,name=resourceVersion"`
|
||||
// +optional
|
||||
Subresource string `json:"subresource,omitempty" protobuf:"bytes,8,opt,name=subresource"`
|
||||
}
|
||||
@ -1,339 +0,0 @@
|
||||
//go:build !ignore_autogenerated
|
||||
// +build !ignore_autogenerated
|
||||
|
||||
/*
|
||||
Copyright The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
// Code generated by conversion-gen. DO NOT EDIT.
|
||||
|
||||
package v1beta1
|
||||
|
||||
import (
|
||||
unsafe "unsafe"
|
||||
|
||||
v1 "k8s.io/api/authentication/v1"
|
||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
conversion "k8s.io/apimachinery/pkg/conversion"
|
||||
runtime "k8s.io/apimachinery/pkg/runtime"
|
||||
types "k8s.io/apimachinery/pkg/types"
|
||||
audit "k8s.io/apiserver/pkg/apis/audit"
|
||||
)
|
||||
|
||||
func init() {
|
||||
localSchemeBuilder.Register(RegisterConversions)
|
||||
}
|
||||
|
||||
// RegisterConversions adds conversion functions to the given scheme.
|
||||
// Public to allow building arbitrary schemes.
|
||||
func RegisterConversions(s *runtime.Scheme) error {
|
||||
if err := s.AddGeneratedConversionFunc((*EventList)(nil), (*audit.EventList)(nil), func(a, b interface{}, scope conversion.Scope) error {
|
||||
return Convert_v1beta1_EventList_To_audit_EventList(a.(*EventList), b.(*audit.EventList), scope)
|
||||
}); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := s.AddGeneratedConversionFunc((*audit.EventList)(nil), (*EventList)(nil), func(a, b interface{}, scope conversion.Scope) error {
|
||||
return Convert_audit_EventList_To_v1beta1_EventList(a.(*audit.EventList), b.(*EventList), scope)
|
||||
}); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := s.AddGeneratedConversionFunc((*GroupResources)(nil), (*audit.GroupResources)(nil), func(a, b interface{}, scope conversion.Scope) error {
|
||||
return Convert_v1beta1_GroupResources_To_audit_GroupResources(a.(*GroupResources), b.(*audit.GroupResources), scope)
|
||||
}); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := s.AddGeneratedConversionFunc((*audit.GroupResources)(nil), (*GroupResources)(nil), func(a, b interface{}, scope conversion.Scope) error {
|
||||
return Convert_audit_GroupResources_To_v1beta1_GroupResources(a.(*audit.GroupResources), b.(*GroupResources), scope)
|
||||
}); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := s.AddGeneratedConversionFunc((*ObjectReference)(nil), (*audit.ObjectReference)(nil), func(a, b interface{}, scope conversion.Scope) error {
|
||||
return Convert_v1beta1_ObjectReference_To_audit_ObjectReference(a.(*ObjectReference), b.(*audit.ObjectReference), scope)
|
||||
}); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := s.AddGeneratedConversionFunc((*audit.ObjectReference)(nil), (*ObjectReference)(nil), func(a, b interface{}, scope conversion.Scope) error {
|
||||
return Convert_audit_ObjectReference_To_v1beta1_ObjectReference(a.(*audit.ObjectReference), b.(*ObjectReference), scope)
|
||||
}); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := s.AddGeneratedConversionFunc((*Policy)(nil), (*audit.Policy)(nil), func(a, b interface{}, scope conversion.Scope) error {
|
||||
return Convert_v1beta1_Policy_To_audit_Policy(a.(*Policy), b.(*audit.Policy), scope)
|
||||
}); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := s.AddGeneratedConversionFunc((*audit.Policy)(nil), (*Policy)(nil), func(a, b interface{}, scope conversion.Scope) error {
|
||||
return Convert_audit_Policy_To_v1beta1_Policy(a.(*audit.Policy), b.(*Policy), scope)
|
||||
}); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := s.AddGeneratedConversionFunc((*PolicyList)(nil), (*audit.PolicyList)(nil), func(a, b interface{}, scope conversion.Scope) error {
|
||||
return Convert_v1beta1_PolicyList_To_audit_PolicyList(a.(*PolicyList), b.(*audit.PolicyList), scope)
|
||||
}); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := s.AddGeneratedConversionFunc((*audit.PolicyList)(nil), (*PolicyList)(nil), func(a, b interface{}, scope conversion.Scope) error {
|
||||
return Convert_audit_PolicyList_To_v1beta1_PolicyList(a.(*audit.PolicyList), b.(*PolicyList), scope)
|
||||
}); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := s.AddGeneratedConversionFunc((*PolicyRule)(nil), (*audit.PolicyRule)(nil), func(a, b interface{}, scope conversion.Scope) error {
|
||||
return Convert_v1beta1_PolicyRule_To_audit_PolicyRule(a.(*PolicyRule), b.(*audit.PolicyRule), scope)
|
||||
}); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := s.AddGeneratedConversionFunc((*audit.PolicyRule)(nil), (*PolicyRule)(nil), func(a, b interface{}, scope conversion.Scope) error {
|
||||
return Convert_audit_PolicyRule_To_v1beta1_PolicyRule(a.(*audit.PolicyRule), b.(*PolicyRule), scope)
|
||||
}); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := s.AddConversionFunc((*audit.Event)(nil), (*Event)(nil), func(a, b interface{}, scope conversion.Scope) error {
|
||||
return Convert_audit_Event_To_v1beta1_Event(a.(*audit.Event), b.(*Event), scope)
|
||||
}); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := s.AddConversionFunc((*Event)(nil), (*audit.Event)(nil), func(a, b interface{}, scope conversion.Scope) error {
|
||||
return Convert_v1beta1_Event_To_audit_Event(a.(*Event), b.(*audit.Event), scope)
|
||||
}); err != nil {
|
||||
return err
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func autoConvert_v1beta1_Event_To_audit_Event(in *Event, out *audit.Event, s conversion.Scope) error {
|
||||
// WARNING: in.ObjectMeta requires manual conversion: does not exist in peer-type
|
||||
out.Level = audit.Level(in.Level)
|
||||
// WARNING: in.Timestamp requires manual conversion: does not exist in peer-type
|
||||
out.AuditID = types.UID(in.AuditID)
|
||||
out.Stage = audit.Stage(in.Stage)
|
||||
out.RequestURI = in.RequestURI
|
||||
out.Verb = in.Verb
|
||||
out.User = in.User
|
||||
out.ImpersonatedUser = (*v1.UserInfo)(unsafe.Pointer(in.ImpersonatedUser))
|
||||
out.SourceIPs = *(*[]string)(unsafe.Pointer(&in.SourceIPs))
|
||||
out.UserAgent = in.UserAgent
|
||||
out.ObjectRef = (*audit.ObjectReference)(unsafe.Pointer(in.ObjectRef))
|
||||
out.ResponseStatus = (*metav1.Status)(unsafe.Pointer(in.ResponseStatus))
|
||||
out.RequestObject = (*runtime.Unknown)(unsafe.Pointer(in.RequestObject))
|
||||
out.ResponseObject = (*runtime.Unknown)(unsafe.Pointer(in.ResponseObject))
|
||||
out.RequestReceivedTimestamp = in.RequestReceivedTimestamp
|
||||
out.StageTimestamp = in.StageTimestamp
|
||||
out.Annotations = *(*map[string]string)(unsafe.Pointer(&in.Annotations))
|
||||
return nil
|
||||
}
|
||||
|
||||
func autoConvert_audit_Event_To_v1beta1_Event(in *audit.Event, out *Event, s conversion.Scope) error {
|
||||
out.Level = Level(in.Level)
|
||||
out.AuditID = types.UID(in.AuditID)
|
||||
out.Stage = Stage(in.Stage)
|
||||
out.RequestURI = in.RequestURI
|
||||
out.Verb = in.Verb
|
||||
out.User = in.User
|
||||
out.ImpersonatedUser = (*v1.UserInfo)(unsafe.Pointer(in.ImpersonatedUser))
|
||||
out.SourceIPs = *(*[]string)(unsafe.Pointer(&in.SourceIPs))
|
||||
out.UserAgent = in.UserAgent
|
||||
out.ObjectRef = (*ObjectReference)(unsafe.Pointer(in.ObjectRef))
|
||||
out.ResponseStatus = (*metav1.Status)(unsafe.Pointer(in.ResponseStatus))
|
||||
out.RequestObject = (*runtime.Unknown)(unsafe.Pointer(in.RequestObject))
|
||||
out.ResponseObject = (*runtime.Unknown)(unsafe.Pointer(in.ResponseObject))
|
||||
out.RequestReceivedTimestamp = in.RequestReceivedTimestamp
|
||||
out.StageTimestamp = in.StageTimestamp
|
||||
out.Annotations = *(*map[string]string)(unsafe.Pointer(&in.Annotations))
|
||||
return nil
|
||||
}
|
||||
|
||||
func autoConvert_v1beta1_EventList_To_audit_EventList(in *EventList, out *audit.EventList, s conversion.Scope) error {
|
||||
out.ListMeta = in.ListMeta
|
||||
if in.Items != nil {
|
||||
in, out := &in.Items, &out.Items
|
||||
*out = make([]audit.Event, len(*in))
|
||||
for i := range *in {
|
||||
if err := Convert_v1beta1_Event_To_audit_Event(&(*in)[i], &(*out)[i], s); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
} else {
|
||||
out.Items = nil
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// Convert_v1beta1_EventList_To_audit_EventList is an autogenerated conversion function.
|
||||
func Convert_v1beta1_EventList_To_audit_EventList(in *EventList, out *audit.EventList, s conversion.Scope) error {
|
||||
return autoConvert_v1beta1_EventList_To_audit_EventList(in, out, s)
|
||||
}
|
||||
|
||||
func autoConvert_audit_EventList_To_v1beta1_EventList(in *audit.EventList, out *EventList, s conversion.Scope) error {
|
||||
out.ListMeta = in.ListMeta
|
||||
if in.Items != nil {
|
||||
in, out := &in.Items, &out.Items
|
||||
*out = make([]Event, len(*in))
|
||||
for i := range *in {
|
||||
if err := Convert_audit_Event_To_v1beta1_Event(&(*in)[i], &(*out)[i], s); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
} else {
|
||||
out.Items = nil
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// Convert_audit_EventList_To_v1beta1_EventList is an autogenerated conversion function.
|
||||
func Convert_audit_EventList_To_v1beta1_EventList(in *audit.EventList, out *EventList, s conversion.Scope) error {
|
||||
return autoConvert_audit_EventList_To_v1beta1_EventList(in, out, s)
|
||||
}
|
||||
|
||||
func autoConvert_v1beta1_GroupResources_To_audit_GroupResources(in *GroupResources, out *audit.GroupResources, s conversion.Scope) error {
|
||||
out.Group = in.Group
|
||||
out.Resources = *(*[]string)(unsafe.Pointer(&in.Resources))
|
||||
out.ResourceNames = *(*[]string)(unsafe.Pointer(&in.ResourceNames))
|
||||
return nil
|
||||
}
|
||||
|
||||
// Convert_v1beta1_GroupResources_To_audit_GroupResources is an autogenerated conversion function.
|
||||
func Convert_v1beta1_GroupResources_To_audit_GroupResources(in *GroupResources, out *audit.GroupResources, s conversion.Scope) error {
|
||||
return autoConvert_v1beta1_GroupResources_To_audit_GroupResources(in, out, s)
|
||||
}
|
||||
|
||||
func autoConvert_audit_GroupResources_To_v1beta1_GroupResources(in *audit.GroupResources, out *GroupResources, s conversion.Scope) error {
|
||||
out.Group = in.Group
|
||||
out.Resources = *(*[]string)(unsafe.Pointer(&in.Resources))
|
||||
out.ResourceNames = *(*[]string)(unsafe.Pointer(&in.ResourceNames))
|
||||
return nil
|
||||
}
|
||||
|
||||
// Convert_audit_GroupResources_To_v1beta1_GroupResources is an autogenerated conversion function.
|
||||
func Convert_audit_GroupResources_To_v1beta1_GroupResources(in *audit.GroupResources, out *GroupResources, s conversion.Scope) error {
|
||||
return autoConvert_audit_GroupResources_To_v1beta1_GroupResources(in, out, s)
|
||||
}
|
||||
|
||||
func autoConvert_v1beta1_ObjectReference_To_audit_ObjectReference(in *ObjectReference, out *audit.ObjectReference, s conversion.Scope) error {
|
||||
out.Resource = in.Resource
|
||||
out.Namespace = in.Namespace
|
||||
out.Name = in.Name
|
||||
out.UID = types.UID(in.UID)
|
||||
out.APIGroup = in.APIGroup
|
||||
out.APIVersion = in.APIVersion
|
||||
out.ResourceVersion = in.ResourceVersion
|
||||
out.Subresource = in.Subresource
|
||||
return nil
|
||||
}
|
||||
|
||||
// Convert_v1beta1_ObjectReference_To_audit_ObjectReference is an autogenerated conversion function.
|
||||
func Convert_v1beta1_ObjectReference_To_audit_ObjectReference(in *ObjectReference, out *audit.ObjectReference, s conversion.Scope) error {
|
||||
return autoConvert_v1beta1_ObjectReference_To_audit_ObjectReference(in, out, s)
|
||||
}
|
||||
|
||||
func autoConvert_audit_ObjectReference_To_v1beta1_ObjectReference(in *audit.ObjectReference, out *ObjectReference, s conversion.Scope) error {
|
||||
out.Resource = in.Resource
|
||||
out.Namespace = in.Namespace
|
||||
out.Name = in.Name
|
||||
out.UID = types.UID(in.UID)
|
||||
out.APIGroup = in.APIGroup
|
||||
out.APIVersion = in.APIVersion
|
||||
out.ResourceVersion = in.ResourceVersion
|
||||
out.Subresource = in.Subresource
|
||||
return nil
|
||||
}
|
||||
|
||||
// Convert_audit_ObjectReference_To_v1beta1_ObjectReference is an autogenerated conversion function.
|
||||
func Convert_audit_ObjectReference_To_v1beta1_ObjectReference(in *audit.ObjectReference, out *ObjectReference, s conversion.Scope) error {
|
||||
return autoConvert_audit_ObjectReference_To_v1beta1_ObjectReference(in, out, s)
|
||||
}
|
||||
|
||||
func autoConvert_v1beta1_Policy_To_audit_Policy(in *Policy, out *audit.Policy, s conversion.Scope) error {
|
||||
out.ObjectMeta = in.ObjectMeta
|
||||
out.Rules = *(*[]audit.PolicyRule)(unsafe.Pointer(&in.Rules))
|
||||
out.OmitStages = *(*[]audit.Stage)(unsafe.Pointer(&in.OmitStages))
|
||||
out.OmitManagedFields = in.OmitManagedFields
|
||||
return nil
|
||||
}
|
||||
|
||||
// Convert_v1beta1_Policy_To_audit_Policy is an autogenerated conversion function.
|
||||
func Convert_v1beta1_Policy_To_audit_Policy(in *Policy, out *audit.Policy, s conversion.Scope) error {
|
||||
return autoConvert_v1beta1_Policy_To_audit_Policy(in, out, s)
|
||||
}
|
||||
|
||||
func autoConvert_audit_Policy_To_v1beta1_Policy(in *audit.Policy, out *Policy, s conversion.Scope) error {
|
||||
out.ObjectMeta = in.ObjectMeta
|
||||
out.Rules = *(*[]PolicyRule)(unsafe.Pointer(&in.Rules))
|
||||
out.OmitStages = *(*[]Stage)(unsafe.Pointer(&in.OmitStages))
|
||||
out.OmitManagedFields = in.OmitManagedFields
|
||||
return nil
|
||||
}
|
||||
|
||||
// Convert_audit_Policy_To_v1beta1_Policy is an autogenerated conversion function.
|
||||
func Convert_audit_Policy_To_v1beta1_Policy(in *audit.Policy, out *Policy, s conversion.Scope) error {
|
||||
return autoConvert_audit_Policy_To_v1beta1_Policy(in, out, s)
|
||||
}
|
||||
|
||||
func autoConvert_v1beta1_PolicyList_To_audit_PolicyList(in *PolicyList, out *audit.PolicyList, s conversion.Scope) error {
|
||||
out.ListMeta = in.ListMeta
|
||||
out.Items = *(*[]audit.Policy)(unsafe.Pointer(&in.Items))
|
||||
return nil
|
||||
}
|
||||
|
||||
// Convert_v1beta1_PolicyList_To_audit_PolicyList is an autogenerated conversion function.
|
||||
func Convert_v1beta1_PolicyList_To_audit_PolicyList(in *PolicyList, out *audit.PolicyList, s conversion.Scope) error {
|
||||
return autoConvert_v1beta1_PolicyList_To_audit_PolicyList(in, out, s)
|
||||
}
|
||||
|
||||
func autoConvert_audit_PolicyList_To_v1beta1_PolicyList(in *audit.PolicyList, out *PolicyList, s conversion.Scope) error {
|
||||
out.ListMeta = in.ListMeta
|
||||
out.Items = *(*[]Policy)(unsafe.Pointer(&in.Items))
|
||||
return nil
|
||||
}
|
||||
|
||||
// Convert_audit_PolicyList_To_v1beta1_PolicyList is an autogenerated conversion function.
|
||||
func Convert_audit_PolicyList_To_v1beta1_PolicyList(in *audit.PolicyList, out *PolicyList, s conversion.Scope) error {
|
||||
return autoConvert_audit_PolicyList_To_v1beta1_PolicyList(in, out, s)
|
||||
}
|
||||
|
||||
func autoConvert_v1beta1_PolicyRule_To_audit_PolicyRule(in *PolicyRule, out *audit.PolicyRule, s conversion.Scope) error {
|
||||
out.Level = audit.Level(in.Level)
|
||||
out.Users = *(*[]string)(unsafe.Pointer(&in.Users))
|
||||
out.UserGroups = *(*[]string)(unsafe.Pointer(&in.UserGroups))
|
||||
out.Verbs = *(*[]string)(unsafe.Pointer(&in.Verbs))
|
||||
out.Resources = *(*[]audit.GroupResources)(unsafe.Pointer(&in.Resources))
|
||||
out.Namespaces = *(*[]string)(unsafe.Pointer(&in.Namespaces))
|
||||
out.NonResourceURLs = *(*[]string)(unsafe.Pointer(&in.NonResourceURLs))
|
||||
out.OmitStages = *(*[]audit.Stage)(unsafe.Pointer(&in.OmitStages))
|
||||
out.OmitManagedFields = (*bool)(unsafe.Pointer(in.OmitManagedFields))
|
||||
return nil
|
||||
}
|
||||
|
||||
// Convert_v1beta1_PolicyRule_To_audit_PolicyRule is an autogenerated conversion function.
|
||||
func Convert_v1beta1_PolicyRule_To_audit_PolicyRule(in *PolicyRule, out *audit.PolicyRule, s conversion.Scope) error {
|
||||
return autoConvert_v1beta1_PolicyRule_To_audit_PolicyRule(in, out, s)
|
||||
}
|
||||
|
||||
func autoConvert_audit_PolicyRule_To_v1beta1_PolicyRule(in *audit.PolicyRule, out *PolicyRule, s conversion.Scope) error {
|
||||
out.Level = Level(in.Level)
|
||||
out.Users = *(*[]string)(unsafe.Pointer(&in.Users))
|
||||
out.UserGroups = *(*[]string)(unsafe.Pointer(&in.UserGroups))
|
||||
out.Verbs = *(*[]string)(unsafe.Pointer(&in.Verbs))
|
||||
out.Resources = *(*[]GroupResources)(unsafe.Pointer(&in.Resources))
|
||||
out.Namespaces = *(*[]string)(unsafe.Pointer(&in.Namespaces))
|
||||
out.NonResourceURLs = *(*[]string)(unsafe.Pointer(&in.NonResourceURLs))
|
||||
out.OmitStages = *(*[]Stage)(unsafe.Pointer(&in.OmitStages))
|
||||
out.OmitManagedFields = (*bool)(unsafe.Pointer(in.OmitManagedFields))
|
||||
return nil
|
||||
}
|
||||
|
||||
// Convert_audit_PolicyRule_To_v1beta1_PolicyRule is an autogenerated conversion function.
|
||||
func Convert_audit_PolicyRule_To_v1beta1_PolicyRule(in *audit.PolicyRule, out *PolicyRule, s conversion.Scope) error {
|
||||
return autoConvert_audit_PolicyRule_To_v1beta1_PolicyRule(in, out, s)
|
||||
}
|
||||
@ -1,299 +0,0 @@
|
||||
//go:build !ignore_autogenerated
|
||||
// +build !ignore_autogenerated
|
||||
|
||||
/*
|
||||
Copyright The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
// Code generated by deepcopy-gen. DO NOT EDIT.
|
||||
|
||||
package v1beta1
|
||||
|
||||
import (
|
||||
v1 "k8s.io/api/authentication/v1"
|
||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
runtime "k8s.io/apimachinery/pkg/runtime"
|
||||
)
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *Event) DeepCopyInto(out *Event) {
|
||||
*out = *in
|
||||
out.TypeMeta = in.TypeMeta
|
||||
in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
|
||||
in.Timestamp.DeepCopyInto(&out.Timestamp)
|
||||
in.User.DeepCopyInto(&out.User)
|
||||
if in.ImpersonatedUser != nil {
|
||||
in, out := &in.ImpersonatedUser, &out.ImpersonatedUser
|
||||
*out = new(v1.UserInfo)
|
||||
(*in).DeepCopyInto(*out)
|
||||
}
|
||||
if in.SourceIPs != nil {
|
||||
in, out := &in.SourceIPs, &out.SourceIPs
|
||||
*out = make([]string, len(*in))
|
||||
copy(*out, *in)
|
||||
}
|
||||
if in.ObjectRef != nil {
|
||||
in, out := &in.ObjectRef, &out.ObjectRef
|
||||
*out = new(ObjectReference)
|
||||
**out = **in
|
||||
}
|
||||
if in.ResponseStatus != nil {
|
||||
in, out := &in.ResponseStatus, &out.ResponseStatus
|
||||
*out = new(metav1.Status)
|
||||
(*in).DeepCopyInto(*out)
|
||||
}
|
||||
if in.RequestObject != nil {
|
||||
in, out := &in.RequestObject, &out.RequestObject
|
||||
*out = new(runtime.Unknown)
|
||||
(*in).DeepCopyInto(*out)
|
||||
}
|
||||
if in.ResponseObject != nil {
|
||||
in, out := &in.ResponseObject, &out.ResponseObject
|
||||
*out = new(runtime.Unknown)
|
||||
(*in).DeepCopyInto(*out)
|
||||
}
|
||||
in.RequestReceivedTimestamp.DeepCopyInto(&out.RequestReceivedTimestamp)
|
||||
in.StageTimestamp.DeepCopyInto(&out.StageTimestamp)
|
||||
if in.Annotations != nil {
|
||||
in, out := &in.Annotations, &out.Annotations
|
||||
*out = make(map[string]string, len(*in))
|
||||
for key, val := range *in {
|
||||
(*out)[key] = val
|
||||
}
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Event.
|
||||
func (in *Event) DeepCopy() *Event {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(Event)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
|
||||
func (in *Event) DeepCopyObject() runtime.Object {
|
||||
if c := in.DeepCopy(); c != nil {
|
||||
return c
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *EventList) DeepCopyInto(out *EventList) {
|
||||
*out = *in
|
||||
out.TypeMeta = in.TypeMeta
|
||||
in.ListMeta.DeepCopyInto(&out.ListMeta)
|
||||
if in.Items != nil {
|
||||
in, out := &in.Items, &out.Items
|
||||
*out = make([]Event, len(*in))
|
||||
for i := range *in {
|
||||
(*in)[i].DeepCopyInto(&(*out)[i])
|
||||
}
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EventList.
|
||||
func (in *EventList) DeepCopy() *EventList {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(EventList)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
|
||||
func (in *EventList) DeepCopyObject() runtime.Object {
|
||||
if c := in.DeepCopy(); c != nil {
|
||||
return c
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *GroupResources) DeepCopyInto(out *GroupResources) {
|
||||
*out = *in
|
||||
if in.Resources != nil {
|
||||
in, out := &in.Resources, &out.Resources
|
||||
*out = make([]string, len(*in))
|
||||
copy(*out, *in)
|
||||
}
|
||||
if in.ResourceNames != nil {
|
||||
in, out := &in.ResourceNames, &out.ResourceNames
|
||||
*out = make([]string, len(*in))
|
||||
copy(*out, *in)
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GroupResources.
|
||||
func (in *GroupResources) DeepCopy() *GroupResources {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(GroupResources)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *ObjectReference) DeepCopyInto(out *ObjectReference) {
|
||||
*out = *in
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ObjectReference.
|
||||
func (in *ObjectReference) DeepCopy() *ObjectReference {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(ObjectReference)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *Policy) DeepCopyInto(out *Policy) {
|
||||
*out = *in
|
||||
out.TypeMeta = in.TypeMeta
|
||||
in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
|
||||
if in.Rules != nil {
|
||||
in, out := &in.Rules, &out.Rules
|
||||
*out = make([]PolicyRule, len(*in))
|
||||
for i := range *in {
|
||||
(*in)[i].DeepCopyInto(&(*out)[i])
|
||||
}
|
||||
}
|
||||
if in.OmitStages != nil {
|
||||
in, out := &in.OmitStages, &out.OmitStages
|
||||
*out = make([]Stage, len(*in))
|
||||
copy(*out, *in)
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Policy.
|
||||
func (in *Policy) DeepCopy() *Policy {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(Policy)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
|
||||
func (in *Policy) DeepCopyObject() runtime.Object {
|
||||
if c := in.DeepCopy(); c != nil {
|
||||
return c
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *PolicyList) DeepCopyInto(out *PolicyList) {
|
||||
*out = *in
|
||||
out.TypeMeta = in.TypeMeta
|
||||
in.ListMeta.DeepCopyInto(&out.ListMeta)
|
||||
if in.Items != nil {
|
||||
in, out := &in.Items, &out.Items
|
||||
*out = make([]Policy, len(*in))
|
||||
for i := range *in {
|
||||
(*in)[i].DeepCopyInto(&(*out)[i])
|
||||
}
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PolicyList.
|
||||
func (in *PolicyList) DeepCopy() *PolicyList {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(PolicyList)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
|
||||
func (in *PolicyList) DeepCopyObject() runtime.Object {
|
||||
if c := in.DeepCopy(); c != nil {
|
||||
return c
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *PolicyRule) DeepCopyInto(out *PolicyRule) {
|
||||
*out = *in
|
||||
if in.Users != nil {
|
||||
in, out := &in.Users, &out.Users
|
||||
*out = make([]string, len(*in))
|
||||
copy(*out, *in)
|
||||
}
|
||||
if in.UserGroups != nil {
|
||||
in, out := &in.UserGroups, &out.UserGroups
|
||||
*out = make([]string, len(*in))
|
||||
copy(*out, *in)
|
||||
}
|
||||
if in.Verbs != nil {
|
||||
in, out := &in.Verbs, &out.Verbs
|
||||
*out = make([]string, len(*in))
|
||||
copy(*out, *in)
|
||||
}
|
||||
if in.Resources != nil {
|
||||
in, out := &in.Resources, &out.Resources
|
||||
*out = make([]GroupResources, len(*in))
|
||||
for i := range *in {
|
||||
(*in)[i].DeepCopyInto(&(*out)[i])
|
||||
}
|
||||
}
|
||||
if in.Namespaces != nil {
|
||||
in, out := &in.Namespaces, &out.Namespaces
|
||||
*out = make([]string, len(*in))
|
||||
copy(*out, *in)
|
||||
}
|
||||
if in.NonResourceURLs != nil {
|
||||
in, out := &in.NonResourceURLs, &out.NonResourceURLs
|
||||
*out = make([]string, len(*in))
|
||||
copy(*out, *in)
|
||||
}
|
||||
if in.OmitStages != nil {
|
||||
in, out := &in.OmitStages, &out.OmitStages
|
||||
*out = make([]Stage, len(*in))
|
||||
copy(*out, *in)
|
||||
}
|
||||
if in.OmitManagedFields != nil {
|
||||
in, out := &in.OmitManagedFields, &out.OmitManagedFields
|
||||
*out = new(bool)
|
||||
**out = **in
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PolicyRule.
|
||||
func (in *PolicyRule) DeepCopy() *PolicyRule {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(PolicyRule)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
@ -1,33 +0,0 @@
|
||||
//go:build !ignore_autogenerated
|
||||
// +build !ignore_autogenerated
|
||||
|
||||
/*
|
||||
Copyright The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
// Code generated by defaulter-gen. DO NOT EDIT.
|
||||
|
||||
package v1beta1
|
||||
|
||||
import (
|
||||
runtime "k8s.io/apimachinery/pkg/runtime"
|
||||
)
|
||||
|
||||
// RegisterDefaults adds defaulters functions to the given scheme.
|
||||
// Public to allow building arbitrary schemes.
|
||||
// All generated defaulters are covering - they call all nested defaulters.
|
||||
func RegisterDefaults(scheme *runtime.Scheme) error {
|
||||
return nil
|
||||
}
|
||||
@ -1,122 +0,0 @@
|
||||
//go:build !ignore_autogenerated
|
||||
// +build !ignore_autogenerated
|
||||
|
||||
/*
|
||||
Copyright The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
// Code generated by prerelease-lifecycle-gen. DO NOT EDIT.
|
||||
|
||||
package v1beta1
|
||||
|
||||
import (
|
||||
schema "k8s.io/apimachinery/pkg/runtime/schema"
|
||||
)
|
||||
|
||||
// APILifecycleIntroduced is an autogenerated function, returning the release in which the API struct was introduced as int versions of major and minor for comparison.
|
||||
// It is controlled by "k8s:prerelease-lifecycle-gen:introduced" tags in types.go.
|
||||
func (in *Event) APILifecycleIntroduced() (major, minor int) {
|
||||
return 1, 8
|
||||
}
|
||||
|
||||
// APILifecycleDeprecated is an autogenerated function, returning the release in which the API struct was or will be deprecated as int versions of major and minor for comparison.
|
||||
// It is controlled by "k8s:prerelease-lifecycle-gen:deprecated" tags in types.go or "k8s:prerelease-lifecycle-gen:introduced" plus three minor.
|
||||
func (in *Event) APILifecycleDeprecated() (major, minor int) {
|
||||
return 1, 21
|
||||
}
|
||||
|
||||
// APILifecycleReplacement is an autogenerated function, returning the group, version, and kind that should be used instead of this deprecated type.
|
||||
// It is controlled by "k8s:prerelease-lifecycle-gen:replacement=<group>,<version>,<kind>" tags in types.go.
|
||||
func (in *Event) APILifecycleReplacement() schema.GroupVersionKind {
|
||||
return schema.GroupVersionKind{Group: "audit.k8s.io", Version: "v1", Kind: "Event"}
|
||||
}
|
||||
|
||||
// APILifecycleRemoved is an autogenerated function, returning the release in which the API is no longer served as int versions of major and minor for comparison.
|
||||
// It is controlled by "k8s:prerelease-lifecycle-gen:removed" tags in types.go or "k8s:prerelease-lifecycle-gen:deprecated" plus three minor.
|
||||
func (in *Event) APILifecycleRemoved() (major, minor int) {
|
||||
return 1, 24
|
||||
}
|
||||
|
||||
// APILifecycleIntroduced is an autogenerated function, returning the release in which the API struct was introduced as int versions of major and minor for comparison.
|
||||
// It is controlled by "k8s:prerelease-lifecycle-gen:introduced" tags in types.go.
|
||||
func (in *EventList) APILifecycleIntroduced() (major, minor int) {
|
||||
return 1, 8
|
||||
}
|
||||
|
||||
// APILifecycleDeprecated is an autogenerated function, returning the release in which the API struct was or will be deprecated as int versions of major and minor for comparison.
|
||||
// It is controlled by "k8s:prerelease-lifecycle-gen:deprecated" tags in types.go or "k8s:prerelease-lifecycle-gen:introduced" plus three minor.
|
||||
func (in *EventList) APILifecycleDeprecated() (major, minor int) {
|
||||
return 1, 21
|
||||
}
|
||||
|
||||
// APILifecycleReplacement is an autogenerated function, returning the group, version, and kind that should be used instead of this deprecated type.
|
||||
// It is controlled by "k8s:prerelease-lifecycle-gen:replacement=<group>,<version>,<kind>" tags in types.go.
|
||||
func (in *EventList) APILifecycleReplacement() schema.GroupVersionKind {
|
||||
return schema.GroupVersionKind{Group: "audit.k8s.io", Version: "v1", Kind: "EventList"}
|
||||
}
|
||||
|
||||
// APILifecycleRemoved is an autogenerated function, returning the release in which the API is no longer served as int versions of major and minor for comparison.
|
||||
// It is controlled by "k8s:prerelease-lifecycle-gen:removed" tags in types.go or "k8s:prerelease-lifecycle-gen:deprecated" plus three minor.
|
||||
func (in *EventList) APILifecycleRemoved() (major, minor int) {
|
||||
return 1, 24
|
||||
}
|
||||
|
||||
// APILifecycleIntroduced is an autogenerated function, returning the release in which the API struct was introduced as int versions of major and minor for comparison.
|
||||
// It is controlled by "k8s:prerelease-lifecycle-gen:introduced" tags in types.go.
|
||||
func (in *Policy) APILifecycleIntroduced() (major, minor int) {
|
||||
return 1, 8
|
||||
}
|
||||
|
||||
// APILifecycleDeprecated is an autogenerated function, returning the release in which the API struct was or will be deprecated as int versions of major and minor for comparison.
|
||||
// It is controlled by "k8s:prerelease-lifecycle-gen:deprecated" tags in types.go or "k8s:prerelease-lifecycle-gen:introduced" plus three minor.
|
||||
func (in *Policy) APILifecycleDeprecated() (major, minor int) {
|
||||
return 1, 21
|
||||
}
|
||||
|
||||
// APILifecycleReplacement is an autogenerated function, returning the group, version, and kind that should be used instead of this deprecated type.
|
||||
// It is controlled by "k8s:prerelease-lifecycle-gen:replacement=<group>,<version>,<kind>" tags in types.go.
|
||||
func (in *Policy) APILifecycleReplacement() schema.GroupVersionKind {
|
||||
return schema.GroupVersionKind{Group: "audit.k8s.io", Version: "v1", Kind: "Policy"}
|
||||
}
|
||||
|
||||
// APILifecycleRemoved is an autogenerated function, returning the release in which the API is no longer served as int versions of major and minor for comparison.
|
||||
// It is controlled by "k8s:prerelease-lifecycle-gen:removed" tags in types.go or "k8s:prerelease-lifecycle-gen:deprecated" plus three minor.
|
||||
func (in *Policy) APILifecycleRemoved() (major, minor int) {
|
||||
return 1, 24
|
||||
}
|
||||
|
||||
// APILifecycleIntroduced is an autogenerated function, returning the release in which the API struct was introduced as int versions of major and minor for comparison.
|
||||
// It is controlled by "k8s:prerelease-lifecycle-gen:introduced" tags in types.go.
|
||||
func (in *PolicyList) APILifecycleIntroduced() (major, minor int) {
|
||||
return 1, 8
|
||||
}
|
||||
|
||||
// APILifecycleDeprecated is an autogenerated function, returning the release in which the API struct was or will be deprecated as int versions of major and minor for comparison.
|
||||
// It is controlled by "k8s:prerelease-lifecycle-gen:deprecated" tags in types.go or "k8s:prerelease-lifecycle-gen:introduced" plus three minor.
|
||||
func (in *PolicyList) APILifecycleDeprecated() (major, minor int) {
|
||||
return 1, 21
|
||||
}
|
||||
|
||||
// APILifecycleReplacement is an autogenerated function, returning the group, version, and kind that should be used instead of this deprecated type.
|
||||
// It is controlled by "k8s:prerelease-lifecycle-gen:replacement=<group>,<version>,<kind>" tags in types.go.
|
||||
func (in *PolicyList) APILifecycleReplacement() schema.GroupVersionKind {
|
||||
return schema.GroupVersionKind{Group: "audit.k8s.io", Version: "v1", Kind: "PolicyList"}
|
||||
}
|
||||
|
||||
// APILifecycleRemoved is an autogenerated function, returning the release in which the API is no longer served as int versions of major and minor for comparison.
|
||||
// It is controlled by "k8s:prerelease-lifecycle-gen:removed" tags in types.go or "k8s:prerelease-lifecycle-gen:deprecated" plus three minor.
|
||||
func (in *PolicyList) APILifecycleRemoved() (major, minor int) {
|
||||
return 1, 24
|
||||
}
|
||||
@ -23,8 +23,6 @@ import (
|
||||
"k8s.io/apimachinery/pkg/runtime/schema"
|
||||
auditinternal "k8s.io/apiserver/pkg/apis/audit"
|
||||
auditv1 "k8s.io/apiserver/pkg/apis/audit/v1"
|
||||
auditv1alpha1 "k8s.io/apiserver/pkg/apis/audit/v1alpha1"
|
||||
auditv1beta1 "k8s.io/apiserver/pkg/apis/audit/v1beta1"
|
||||
"k8s.io/apiserver/pkg/apis/audit/validation"
|
||||
"k8s.io/apiserver/pkg/audit"
|
||||
|
||||
@ -33,8 +31,6 @@ import (
|
||||
|
||||
var (
|
||||
apiGroupVersions = []schema.GroupVersion{
|
||||
auditv1beta1.SchemeGroupVersion,
|
||||
auditv1alpha1.SchemeGroupVersion,
|
||||
auditv1.SchemeGroupVersion,
|
||||
}
|
||||
apiGroupVersionSet = map[schema.GroupVersion]bool{}
|
||||
@ -78,10 +74,6 @@ func LoadPolicyFromBytes(policyDef []byte) (*auditinternal.Policy, error) {
|
||||
return nil, fmt.Errorf("unknown group version field %v in policy", gvk)
|
||||
}
|
||||
|
||||
if gv != auditv1.SchemeGroupVersion {
|
||||
klog.Warningf("%q is deprecated and will be removed in a future release, use %q instead", gv, auditv1.SchemeGroupVersion)
|
||||
}
|
||||
|
||||
if err := validation.ValidatePolicy(policy); err != nil {
|
||||
return nil, err.ToAggregate()
|
||||
}
|
||||
|
||||
@ -90,19 +90,17 @@ var expectedPolicy = &audit.Policy{
|
||||
}
|
||||
|
||||
func TestParser(t *testing.T) {
|
||||
for _, version := range []string{"v1", "v1alpha1", "v1beta1"} {
|
||||
policyDef := strings.Replace(policyDefPattern, "{version}", version, 1)
|
||||
f, err := writePolicy(t, policyDef)
|
||||
require.NoError(t, err)
|
||||
defer os.Remove(f)
|
||||
policyDef := strings.Replace(policyDefPattern, "{version}", "v1", 1)
|
||||
f, err := writePolicy(t, policyDef)
|
||||
require.NoError(t, err)
|
||||
defer os.Remove(f)
|
||||
|
||||
policy, err := LoadPolicyFromFile(f)
|
||||
require.NoError(t, err)
|
||||
policy, err := LoadPolicyFromFile(f)
|
||||
require.NoError(t, err)
|
||||
|
||||
assert.Len(t, policy.Rules, 3) // Sanity check.
|
||||
if !reflect.DeepEqual(policy, expectedPolicy) {
|
||||
t.Errorf("Unexpected policy! Diff:\n%s", diff.ObjectDiff(policy, expectedPolicy))
|
||||
}
|
||||
assert.Len(t, policy.Rules, 3) // Sanity check.
|
||||
if !reflect.DeepEqual(policy, expectedPolicy) {
|
||||
t.Errorf("Unexpected policy! Diff:\n%s", diff.ObjectDiff(policy, expectedPolicy))
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@ -25,8 +25,6 @@ import (
|
||||
utilruntime "k8s.io/apimachinery/pkg/util/runtime"
|
||||
auditinternal "k8s.io/apiserver/pkg/apis/audit"
|
||||
"k8s.io/apiserver/pkg/apis/audit/v1"
|
||||
"k8s.io/apiserver/pkg/apis/audit/v1alpha1"
|
||||
"k8s.io/apiserver/pkg/apis/audit/v1beta1"
|
||||
)
|
||||
|
||||
var Scheme = runtime.NewScheme()
|
||||
@ -35,8 +33,6 @@ var Codecs = serializer.NewCodecFactory(Scheme)
|
||||
func init() {
|
||||
metav1.AddToGroupVersion(Scheme, schema.GroupVersion{Version: "v1"})
|
||||
utilruntime.Must(v1.AddToScheme(Scheme))
|
||||
utilruntime.Must(v1alpha1.AddToScheme(Scheme))
|
||||
utilruntime.Must(v1beta1.AddToScheme(Scheme))
|
||||
utilruntime.Must(auditinternal.AddToScheme(Scheme))
|
||||
utilruntime.Must(Scheme.SetVersionPriority(v1.SchemeGroupVersion, v1beta1.SchemeGroupVersion, v1alpha1.SchemeGroupVersion))
|
||||
utilruntime.Must(Scheme.SetVersionPriority(v1.SchemeGroupVersion))
|
||||
}
|
||||
|
||||
@ -32,8 +32,6 @@ import (
|
||||
"k8s.io/apimachinery/pkg/util/sets"
|
||||
auditinternal "k8s.io/apiserver/pkg/apis/audit"
|
||||
auditv1 "k8s.io/apiserver/pkg/apis/audit/v1"
|
||||
auditv1alpha1 "k8s.io/apiserver/pkg/apis/audit/v1alpha1"
|
||||
auditv1beta1 "k8s.io/apiserver/pkg/apis/audit/v1beta1"
|
||||
"k8s.io/apiserver/pkg/audit"
|
||||
"k8s.io/apiserver/pkg/audit/policy"
|
||||
"k8s.io/apiserver/pkg/server"
|
||||
@ -235,8 +233,6 @@ func validateBackendBatchOptions(pluginName string, options AuditBatchOptions) e
|
||||
}
|
||||
|
||||
var knownGroupVersions = []schema.GroupVersion{
|
||||
auditv1alpha1.SchemeGroupVersion,
|
||||
auditv1beta1.SchemeGroupVersion,
|
||||
auditv1.SchemeGroupVersion,
|
||||
}
|
||||
|
||||
|
||||
@ -33,7 +33,6 @@ import (
|
||||
auditinternal "k8s.io/apiserver/pkg/apis/audit"
|
||||
"k8s.io/apiserver/pkg/apis/audit/install"
|
||||
auditv1 "k8s.io/apiserver/pkg/apis/audit/v1"
|
||||
auditv1beta1 "k8s.io/apiserver/pkg/apis/audit/v1beta1"
|
||||
"k8s.io/apiserver/pkg/audit"
|
||||
)
|
||||
|
||||
@ -145,7 +144,7 @@ func TestLogEventsJson(t *testing.T) {
|
||||
},
|
||||
},
|
||||
} {
|
||||
versions := []schema.GroupVersion{auditv1.SchemeGroupVersion, auditv1beta1.SchemeGroupVersion}
|
||||
versions := []schema.GroupVersion{auditv1.SchemeGroupVersion}
|
||||
for _, version := range versions {
|
||||
var buf bytes.Buffer
|
||||
backend := NewBackend(&buf, FormatJson, version)
|
||||
|
||||
@ -37,7 +37,6 @@ import (
|
||||
"k8s.io/apimachinery/pkg/util/wait"
|
||||
auditinternal "k8s.io/apiserver/pkg/apis/audit"
|
||||
auditv1 "k8s.io/apiserver/pkg/apis/audit/v1"
|
||||
auditv1beta1 "k8s.io/apiserver/pkg/apis/audit/v1beta1"
|
||||
"k8s.io/apiserver/pkg/audit"
|
||||
"k8s.io/client-go/tools/clientcmd/api/v1"
|
||||
)
|
||||
@ -121,7 +120,7 @@ func newWebhook(t *testing.T, endpoint string, groupVersion schema.GroupVersion)
|
||||
}
|
||||
|
||||
func TestWebhook(t *testing.T) {
|
||||
versions := []schema.GroupVersion{auditv1.SchemeGroupVersion, auditv1beta1.SchemeGroupVersion}
|
||||
versions := []schema.GroupVersion{auditv1.SchemeGroupVersion}
|
||||
for _, version := range versions {
|
||||
gotEvents := false
|
||||
|
||||
|
||||
@ -40,7 +40,6 @@ import (
|
||||
"k8s.io/apiserver/pkg/admission/plugin/webhook/mutating"
|
||||
auditinternal "k8s.io/apiserver/pkg/apis/audit"
|
||||
auditv1 "k8s.io/apiserver/pkg/apis/audit/v1"
|
||||
auditv1beta1 "k8s.io/apiserver/pkg/apis/audit/v1beta1"
|
||||
"k8s.io/client-go/kubernetes"
|
||||
clientset "k8s.io/client-go/kubernetes"
|
||||
kubeapiservertesting "k8s.io/kubernetes/cmd/kube-apiserver/app/testing"
|
||||
@ -108,8 +107,7 @@ rules:
|
||||
patch, _ = json.Marshal(jsonpatch.Patch{})
|
||||
auditTestUser = "system:apiserver"
|
||||
versions = map[string]schema.GroupVersion{
|
||||
"audit.k8s.io/v1": auditv1.SchemeGroupVersion,
|
||||
"audit.k8s.io/v1beta1": auditv1beta1.SchemeGroupVersion,
|
||||
"audit.k8s.io/v1": auditv1.SchemeGroupVersion,
|
||||
}
|
||||
|
||||
expectedEvents = []utils.AuditEvent{
|
||||
|
||||
2
vendor/modules.txt
vendored
2
vendor/modules.txt
vendored
@ -1456,8 +1456,6 @@ k8s.io/apiserver/pkg/apis/apiserver/v1beta1
|
||||
k8s.io/apiserver/pkg/apis/audit
|
||||
k8s.io/apiserver/pkg/apis/audit/install
|
||||
k8s.io/apiserver/pkg/apis/audit/v1
|
||||
k8s.io/apiserver/pkg/apis/audit/v1alpha1
|
||||
k8s.io/apiserver/pkg/apis/audit/v1beta1
|
||||
k8s.io/apiserver/pkg/apis/audit/validation
|
||||
k8s.io/apiserver/pkg/apis/config
|
||||
k8s.io/apiserver/pkg/apis/config/v1
|
||||
|
||||
Loading…
Reference in New Issue
Block a user