1. Packages
  2. Kubernetes
  3. API Docs
  4. admissionregistration
  5. admissionregistration/v1beta1
  6. ValidatingAdmissionPolicyList
Kubernetes v4.18.1 published on Friday, Sep 13, 2024 by Pulumi

kubernetes.admissionregistration.k8s.io/v1beta1.ValidatingAdmissionPolicyList

Explore with Pulumi AI

kubernetes logo
Kubernetes v4.18.1 published on Friday, Sep 13, 2024 by Pulumi

    ValidatingAdmissionPolicyList is a list of ValidatingAdmissionPolicy.

    Create ValidatingAdmissionPolicyList Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new ValidatingAdmissionPolicyList(name: string, args: ValidatingAdmissionPolicyList, opts?: CustomResourceOptions);
    @overload
    def ValidatingAdmissionPolicyList(resource_name: str,
                                      args: ValidatingAdmissionPolicyListArgs,
                                      opts: Optional[ResourceOptions] = None)
    
    @overload
    def ValidatingAdmissionPolicyList(resource_name: str,
                                      opts: Optional[ResourceOptions] = None,
                                      items: Optional[Sequence[_admissionregistration_k8s_io.v1beta1.ValidatingAdmissionPolicyArgs]] = None,
                                      metadata: Optional[_meta.v1.ListMetaArgs] = None)
    func NewValidatingAdmissionPolicyList(ctx *Context, name string, args ValidatingAdmissionPolicyListArgs, opts ...ResourceOption) (*ValidatingAdmissionPolicyList, error)
    public ValidatingAdmissionPolicyList(string name, ValidatingAdmissionPolicyListArgs args, CustomResourceOptions? opts = null)
    public ValidatingAdmissionPolicyList(String name, ValidatingAdmissionPolicyListArgs args)
    public ValidatingAdmissionPolicyList(String name, ValidatingAdmissionPolicyListArgs args, CustomResourceOptions options)
    
    type: kubernetes:admissionregistration.k8s.io/v1beta1:ValidatingAdmissionPolicyList
    properties: # The arguments to resource properties.
    options: # Bag of options to control resource's behavior.
    
    

    Parameters

    name string
    The unique name of the resource.
    args ValidatingAdmissionPolicyList
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args ValidatingAdmissionPolicyListArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args ValidatingAdmissionPolicyListArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args ValidatingAdmissionPolicyListArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args ValidatingAdmissionPolicyListArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var examplevalidatingAdmissionPolicyListResourceResourceFromAdmissionregistration_k8s_iov1beta1 = new Kubernetes.AdmissionRegistration.V1Beta1.ValidatingAdmissionPolicyList("examplevalidatingAdmissionPolicyListResourceResourceFromAdmissionregistration.k8s.iov1beta1", new()
    {
        Items = new[]
        {
            new Kubernetes.Types.Inputs.AdmissionRegistration.V1Beta1.ValidatingAdmissionPolicyArgs
            {
                ApiVersion = "admissionregistration.k8s.io/v1beta1",
                Kind = "ValidatingAdmissionPolicy",
                Metadata = new Kubernetes.Types.Inputs.Meta.V1.ObjectMetaArgs
                {
                    Annotations = 
                    {
                        { "string", "string" },
                    },
                    ClusterName = "string",
                    CreationTimestamp = "string",
                    DeletionGracePeriodSeconds = 0,
                    DeletionTimestamp = "string",
                    Finalizers = new[]
                    {
                        "string",
                    },
                    GenerateName = "string",
                    Generation = 0,
                    Labels = 
                    {
                        { "string", "string" },
                    },
                    ManagedFields = new[]
                    {
                        new Kubernetes.Types.Inputs.Meta.V1.ManagedFieldsEntryArgs
                        {
                            ApiVersion = "string",
                            FieldsType = "string",
                            FieldsV1 = "{}",
                            Manager = "string",
                            Operation = "string",
                            Subresource = "string",
                            Time = "string",
                        },
                    },
                    Name = "string",
                    Namespace = "string",
                    OwnerReferences = new[]
                    {
                        new Kubernetes.Types.Inputs.Meta.V1.OwnerReferenceArgs
                        {
                            ApiVersion = "string",
                            Kind = "string",
                            Name = "string",
                            Uid = "string",
                            BlockOwnerDeletion = false,
                            Controller = false,
                        },
                    },
                    ResourceVersion = "string",
                    SelfLink = "string",
                    Uid = "string",
                },
                Spec = new Kubernetes.Types.Inputs.AdmissionRegistration.V1Beta1.ValidatingAdmissionPolicySpecArgs
                {
                    AuditAnnotations = new[]
                    {
                        new Kubernetes.Types.Inputs.AdmissionRegistration.V1Beta1.AuditAnnotationArgs
                        {
                            Key = "string",
                            ValueExpression = "string",
                        },
                    },
                    FailurePolicy = "string",
                    MatchConditions = new[]
                    {
                        new Kubernetes.Types.Inputs.AdmissionRegistration.V1Beta1.MatchConditionArgs
                        {
                            Expression = "string",
                            Name = "string",
                        },
                    },
                    MatchConstraints = new Kubernetes.Types.Inputs.AdmissionRegistration.V1Beta1.MatchResourcesArgs
                    {
                        ExcludeResourceRules = new[]
                        {
                            new Kubernetes.Types.Inputs.AdmissionRegistration.V1Beta1.NamedRuleWithOperationsArgs
                            {
                                ApiGroups = new[]
                                {
                                    "string",
                                },
                                ApiVersions = new[]
                                {
                                    "string",
                                },
                                Operations = new[]
                                {
                                    "string",
                                },
                                ResourceNames = new[]
                                {
                                    "string",
                                },
                                Resources = new[]
                                {
                                    "string",
                                },
                                Scope = "string",
                            },
                        },
                        MatchPolicy = "string",
                        NamespaceSelector = new Kubernetes.Types.Inputs.Meta.V1.LabelSelectorArgs
                        {
                            MatchExpressions = new[]
                            {
                                new Kubernetes.Types.Inputs.Meta.V1.LabelSelectorRequirementArgs
                                {
                                    Key = "string",
                                    Operator = "string",
                                    Values = new[]
                                    {
                                        "string",
                                    },
                                },
                            },
                            MatchLabels = 
                            {
                                { "string", "string" },
                            },
                        },
                        ObjectSelector = new Kubernetes.Types.Inputs.Meta.V1.LabelSelectorArgs
                        {
                            MatchExpressions = new[]
                            {
                                new Kubernetes.Types.Inputs.Meta.V1.LabelSelectorRequirementArgs
                                {
                                    Key = "string",
                                    Operator = "string",
                                    Values = new[]
                                    {
                                        "string",
                                    },
                                },
                            },
                            MatchLabels = 
                            {
                                { "string", "string" },
                            },
                        },
                        ResourceRules = new[]
                        {
                            new Kubernetes.Types.Inputs.AdmissionRegistration.V1Beta1.NamedRuleWithOperationsArgs
                            {
                                ApiGroups = new[]
                                {
                                    "string",
                                },
                                ApiVersions = new[]
                                {
                                    "string",
                                },
                                Operations = new[]
                                {
                                    "string",
                                },
                                ResourceNames = new[]
                                {
                                    "string",
                                },
                                Resources = new[]
                                {
                                    "string",
                                },
                                Scope = "string",
                            },
                        },
                    },
                    ParamKind = new Kubernetes.Types.Inputs.AdmissionRegistration.V1Beta1.ParamKindArgs
                    {
                        ApiVersion = "string",
                        Kind = "string",
                    },
                    Validations = new[]
                    {
                        new Kubernetes.Types.Inputs.AdmissionRegistration.V1Beta1.ValidationArgs
                        {
                            Expression = "string",
                            Message = "string",
                            MessageExpression = "string",
                            Reason = "string",
                        },
                    },
                    Variables = new[]
                    {
                        new Kubernetes.Types.Inputs.AdmissionRegistration.V1Beta1.VariableArgs
                        {
                            Expression = "string",
                            Name = "string",
                        },
                    },
                },
                Status = new Kubernetes.Types.Inputs.AdmissionRegistration.V1Beta1.ValidatingAdmissionPolicyStatusArgs
                {
                    Conditions = new[]
                    {
                        new Kubernetes.Types.Inputs.Meta.V1.ConditionArgs
                        {
                            LastTransitionTime = "string",
                            Message = "string",
                            Reason = "string",
                            Status = "string",
                            Type = "string",
                            ObservedGeneration = 0,
                        },
                    },
                    ObservedGeneration = 0,
                    TypeChecking = new Kubernetes.Types.Inputs.AdmissionRegistration.V1Beta1.TypeCheckingArgs
                    {
                        ExpressionWarnings = new[]
                        {
                            new Kubernetes.Types.Inputs.AdmissionRegistration.V1Beta1.ExpressionWarningArgs
                            {
                                FieldRef = "string",
                                Warning = "string",
                            },
                        },
                    },
                },
            },
        },
        ApiVersion = "string",
        Kind = "string",
        Metadata = new Kubernetes.Types.Inputs.Meta.V1.ListMetaArgs
        {
            Continue = "string",
            RemainingItemCount = 0,
            ResourceVersion = "string",
            SelfLink = "string",
        },
    });
    
    example, err := admissionregistrationv1beta1.NewValidatingAdmissionPolicyList(ctx, "examplevalidatingAdmissionPolicyListResourceResourceFromAdmissionregistration.k8s.iov1beta1", &admissionregistrationv1beta1.ValidatingAdmissionPolicyListArgs{
    	Items: admissionregistrationv1beta1.ValidatingAdmissionPolicyTypeArray{
    		&admissionregistrationv1beta1.ValidatingAdmissionPolicyTypeArgs{
    			ApiVersion: pulumi.String("admissionregistration.k8s.io/v1beta1"),
    			Kind:       pulumi.String("ValidatingAdmissionPolicy"),
    			Metadata: &metav1.ObjectMetaArgs{
    				Annotations: pulumi.StringMap{
    					"string": pulumi.String("string"),
    				},
    				ClusterName:                pulumi.String("string"),
    				CreationTimestamp:          pulumi.String("string"),
    				DeletionGracePeriodSeconds: pulumi.Int(0),
    				DeletionTimestamp:          pulumi.String("string"),
    				Finalizers: pulumi.StringArray{
    					pulumi.String("string"),
    				},
    				GenerateName: pulumi.String("string"),
    				Generation:   pulumi.Int(0),
    				Labels: pulumi.StringMap{
    					"string": pulumi.String("string"),
    				},
    				ManagedFields: metav1.ManagedFieldsEntryArray{
    					&metav1.ManagedFieldsEntryArgs{
    						ApiVersion:  pulumi.String("string"),
    						FieldsType:  pulumi.String("string"),
    						FieldsV1:    pulumi.Any("{}"),
    						Manager:     pulumi.String("string"),
    						Operation:   pulumi.String("string"),
    						Subresource: pulumi.String("string"),
    						Time:        pulumi.String("string"),
    					},
    				},
    				Name:      pulumi.String("string"),
    				Namespace: pulumi.String("string"),
    				OwnerReferences: metav1.OwnerReferenceArray{
    					&metav1.OwnerReferenceArgs{
    						ApiVersion:         pulumi.String("string"),
    						Kind:               pulumi.String("string"),
    						Name:               pulumi.String("string"),
    						Uid:                pulumi.String("string"),
    						BlockOwnerDeletion: pulumi.Bool(false),
    						Controller:         pulumi.Bool(false),
    					},
    				},
    				ResourceVersion: pulumi.String("string"),
    				SelfLink:        pulumi.String("string"),
    				Uid:             pulumi.String("string"),
    			},
    			Spec: &admissionregistrationv1beta1.ValidatingAdmissionPolicySpecArgs{
    				AuditAnnotations: admissionregistrationv1beta1.AuditAnnotationArray{
    					&admissionregistrationv1beta1.AuditAnnotationArgs{
    						Key:             pulumi.String("string"),
    						ValueExpression: pulumi.String("string"),
    					},
    				},
    				FailurePolicy: pulumi.String("string"),
    				MatchConditions: admissionregistrationv1beta1.MatchConditionArray{
    					&admissionregistrationv1beta1.MatchConditionArgs{
    						Expression: pulumi.String("string"),
    						Name:       pulumi.String("string"),
    					},
    				},
    				MatchConstraints: &admissionregistrationv1beta1.MatchResourcesArgs{
    					ExcludeResourceRules: admissionregistrationv1beta1.NamedRuleWithOperationsArray{
    						&admissionregistrationv1beta1.NamedRuleWithOperationsArgs{
    							ApiGroups: pulumi.StringArray{
    								pulumi.String("string"),
    							},
    							ApiVersions: pulumi.StringArray{
    								pulumi.String("string"),
    							},
    							Operations: pulumi.StringArray{
    								pulumi.String("string"),
    							},
    							ResourceNames: pulumi.StringArray{
    								pulumi.String("string"),
    							},
    							Resources: pulumi.StringArray{
    								pulumi.String("string"),
    							},
    							Scope: pulumi.String("string"),
    						},
    					},
    					MatchPolicy: pulumi.String("string"),
    					NamespaceSelector: &metav1.LabelSelectorArgs{
    						MatchExpressions: metav1.LabelSelectorRequirementArray{
    							&metav1.LabelSelectorRequirementArgs{
    								Key:      pulumi.String("string"),
    								Operator: pulumi.String("string"),
    								Values: pulumi.StringArray{
    									pulumi.String("string"),
    								},
    							},
    						},
    						MatchLabels: pulumi.StringMap{
    							"string": pulumi.String("string"),
    						},
    					},
    					ObjectSelector: &metav1.LabelSelectorArgs{
    						MatchExpressions: metav1.LabelSelectorRequirementArray{
    							&metav1.LabelSelectorRequirementArgs{
    								Key:      pulumi.String("string"),
    								Operator: pulumi.String("string"),
    								Values: pulumi.StringArray{
    									pulumi.String("string"),
    								},
    							},
    						},
    						MatchLabels: pulumi.StringMap{
    							"string": pulumi.String("string"),
    						},
    					},
    					ResourceRules: admissionregistrationv1beta1.NamedRuleWithOperationsArray{
    						&admissionregistrationv1beta1.NamedRuleWithOperationsArgs{
    							ApiGroups: pulumi.StringArray{
    								pulumi.String("string"),
    							},
    							ApiVersions: pulumi.StringArray{
    								pulumi.String("string"),
    							},
    							Operations: pulumi.StringArray{
    								pulumi.String("string"),
    							},
    							ResourceNames: pulumi.StringArray{
    								pulumi.String("string"),
    							},
    							Resources: pulumi.StringArray{
    								pulumi.String("string"),
    							},
    							Scope: pulumi.String("string"),
    						},
    					},
    				},
    				ParamKind: &admissionregistrationv1beta1.ParamKindArgs{
    					ApiVersion: pulumi.String("string"),
    					Kind:       pulumi.String("string"),
    				},
    				Validations: admissionregistrationv1beta1.ValidationArray{
    					&admissionregistrationv1beta1.ValidationArgs{
    						Expression:        pulumi.String("string"),
    						Message:           pulumi.String("string"),
    						MessageExpression: pulumi.String("string"),
    						Reason:            pulumi.String("string"),
    					},
    				},
    				Variables: admissionregistrationv1beta1.VariableArray{
    					&admissionregistrationv1beta1.VariableArgs{
    						Expression: pulumi.String("string"),
    						Name:       pulumi.String("string"),
    					},
    				},
    			},
    			Status: &admissionregistrationv1beta1.ValidatingAdmissionPolicyStatusArgs{
    				Conditions: metav1.ConditionArray{
    					&metav1.ConditionArgs{
    						LastTransitionTime: pulumi.String("string"),
    						Message:            pulumi.String("string"),
    						Reason:             pulumi.String("string"),
    						Status:             pulumi.String("string"),
    						Type:               pulumi.String("string"),
    						ObservedGeneration: pulumi.Int(0),
    					},
    				},
    				ObservedGeneration: pulumi.Int(0),
    				TypeChecking: &admissionregistrationv1beta1.TypeCheckingArgs{
    					ExpressionWarnings: admissionregistrationv1beta1.ExpressionWarningArray{
    						&admissionregistrationv1beta1.ExpressionWarningArgs{
    							FieldRef: pulumi.String("string"),
    							Warning:  pulumi.String("string"),
    						},
    					},
    				},
    			},
    		},
    	},
    	ApiVersion: pulumi.String("string"),
    	Kind:       pulumi.String("string"),
    	Metadata: &metav1.ListMetaArgs{
    		Continue:           pulumi.String("string"),
    		RemainingItemCount: pulumi.Int(0),
    		ResourceVersion:    pulumi.String("string"),
    		SelfLink:           pulumi.String("string"),
    	},
    })
    
    var examplevalidatingAdmissionPolicyListResourceResourceFromAdmissionregistration_k8s_iov1beta1 = new ValidatingAdmissionPolicyList("examplevalidatingAdmissionPolicyListResourceResourceFromAdmissionregistration.k8s.iov1beta1", ValidatingAdmissionPolicyListArgs.builder()
        .items(ValidatingAdmissionPolicyArgs.builder()
            .apiVersion("admissionregistration.k8s.io/v1beta1")
            .kind("ValidatingAdmissionPolicy")
            .metadata(ObjectMetaArgs.builder()
                .annotations(Map.of("string", "string"))
                .clusterName("string")
                .creationTimestamp("string")
                .deletionGracePeriodSeconds(0)
                .deletionTimestamp("string")
                .finalizers("string")
                .generateName("string")
                .generation(0)
                .labels(Map.of("string", "string"))
                .managedFields(ManagedFieldsEntryArgs.builder()
                    .apiVersion("string")
                    .fieldsType("string")
                    .fieldsV1("{}")
                    .manager("string")
                    .operation("string")
                    .subresource("string")
                    .time("string")
                    .build())
                .name("string")
                .namespace("string")
                .ownerReferences(OwnerReferenceArgs.builder()
                    .apiVersion("string")
                    .kind("string")
                    .name("string")
                    .uid("string")
                    .blockOwnerDeletion(false)
                    .controller(false)
                    .build())
                .resourceVersion("string")
                .selfLink("string")
                .uid("string")
                .build())
            .spec(ValidatingAdmissionPolicySpecArgs.builder()
                .auditAnnotations(AuditAnnotationArgs.builder()
                    .key("string")
                    .valueExpression("string")
                    .build())
                .failurePolicy("string")
                .matchConditions(MatchConditionArgs.builder()
                    .expression("string")
                    .name("string")
                    .build())
                .matchConstraints(MatchResourcesArgs.builder()
                    .excludeResourceRules(NamedRuleWithOperationsArgs.builder()
                        .apiGroups("string")
                        .apiVersions("string")
                        .operations("string")
                        .resourceNames("string")
                        .resources("string")
                        .scope("string")
                        .build())
                    .matchPolicy("string")
                    .namespaceSelector(LabelSelectorArgs.builder()
                        .matchExpressions(LabelSelectorRequirementArgs.builder()
                            .key("string")
                            .operator("string")
                            .values("string")
                            .build())
                        .matchLabels(Map.of("string", "string"))
                        .build())
                    .objectSelector(LabelSelectorArgs.builder()
                        .matchExpressions(LabelSelectorRequirementArgs.builder()
                            .key("string")
                            .operator("string")
                            .values("string")
                            .build())
                        .matchLabels(Map.of("string", "string"))
                        .build())
                    .resourceRules(NamedRuleWithOperationsArgs.builder()
                        .apiGroups("string")
                        .apiVersions("string")
                        .operations("string")
                        .resourceNames("string")
                        .resources("string")
                        .scope("string")
                        .build())
                    .build())
                .paramKind(ParamKindArgs.builder()
                    .apiVersion("string")
                    .kind("string")
                    .build())
                .validations(ValidationArgs.builder()
                    .expression("string")
                    .message("string")
                    .messageExpression("string")
                    .reason("string")
                    .build())
                .variables(VariableArgs.builder()
                    .expression("string")
                    .name("string")
                    .build())
                .build())
            .status(ValidatingAdmissionPolicyStatusArgs.builder()
                .conditions(ConditionArgs.builder()
                    .lastTransitionTime("string")
                    .message("string")
                    .reason("string")
                    .status("string")
                    .type("string")
                    .observedGeneration(0)
                    .build())
                .observedGeneration(0)
                .typeChecking(TypeCheckingArgs.builder()
                    .expressionWarnings(ExpressionWarningArgs.builder()
                        .fieldRef("string")
                        .warning("string")
                        .build())
                    .build())
                .build())
            .build())
        .apiVersion("string")
        .kind("string")
        .metadata(ListMetaArgs.builder()
            .continue_("string")
            .remainingItemCount(0)
            .resourceVersion("string")
            .selfLink("string")
            .build())
        .build());
    
    examplevalidating_admission_policy_list_resource_resource_from_admissionregistration_k8s_iov1beta1 = kubernetes.admissionregistration.v1beta1.ValidatingAdmissionPolicyList("examplevalidatingAdmissionPolicyListResourceResourceFromAdmissionregistration.k8s.iov1beta1",
        items=[{
            "apiVersion": "admissionregistration.k8s.io/v1beta1",
            "kind": "ValidatingAdmissionPolicy",
            "metadata": {
                "annotations": {
                    "string": "string",
                },
                "clusterName": "string",
                "creationTimestamp": "string",
                "deletionGracePeriodSeconds": 0,
                "deletionTimestamp": "string",
                "finalizers": ["string"],
                "generateName": "string",
                "generation": 0,
                "labels": {
                    "string": "string",
                },
                "managedFields": [{
                    "apiVersion": "string",
                    "fieldsType": "string",
                    "fieldsV1": "{}",
                    "manager": "string",
                    "operation": "string",
                    "subresource": "string",
                    "time": "string",
                }],
                "name": "string",
                "namespace": "string",
                "ownerReferences": [{
                    "apiVersion": "string",
                    "kind": "string",
                    "name": "string",
                    "uid": "string",
                    "blockOwnerDeletion": False,
                    "controller": False,
                }],
                "resourceVersion": "string",
                "selfLink": "string",
                "uid": "string",
            },
            "spec": {
                "auditAnnotations": [{
                    "key": "string",
                    "valueExpression": "string",
                }],
                "failurePolicy": "string",
                "matchConditions": [{
                    "expression": "string",
                    "name": "string",
                }],
                "matchConstraints": {
                    "excludeResourceRules": [{
                        "apiGroups": ["string"],
                        "apiVersions": ["string"],
                        "operations": ["string"],
                        "resourceNames": ["string"],
                        "resources": ["string"],
                        "scope": "string",
                    }],
                    "matchPolicy": "string",
                    "namespaceSelector": {
                        "matchExpressions": [{
                            "key": "string",
                            "operator": "string",
                            "values": ["string"],
                        }],
                        "matchLabels": {
                            "string": "string",
                        },
                    },
                    "objectSelector": {
                        "matchExpressions": [{
                            "key": "string",
                            "operator": "string",
                            "values": ["string"],
                        }],
                        "matchLabels": {
                            "string": "string",
                        },
                    },
                    "resourceRules": [{
                        "apiGroups": ["string"],
                        "apiVersions": ["string"],
                        "operations": ["string"],
                        "resourceNames": ["string"],
                        "resources": ["string"],
                        "scope": "string",
                    }],
                },
                "paramKind": {
                    "apiVersion": "string",
                    "kind": "string",
                },
                "validations": [{
                    "expression": "string",
                    "message": "string",
                    "messageExpression": "string",
                    "reason": "string",
                }],
                "variables": [{
                    "expression": "string",
                    "name": "string",
                }],
            },
            "status": {
                "conditions": [{
                    "lastTransitionTime": "string",
                    "message": "string",
                    "reason": "string",
                    "status": "string",
                    "type": "string",
                    "observedGeneration": 0,
                }],
                "observedGeneration": 0,
                "typeChecking": {
                    "expressionWarnings": [{
                        "fieldRef": "string",
                        "warning": "string",
                    }],
                },
            },
        }],
        api_version="string",
        kind="string",
        metadata={
            "continue": "string",
            "remainingItemCount": 0,
            "resourceVersion": "string",
            "selfLink": "string",
        })
    
    const examplevalidatingAdmissionPolicyListResourceResourceFromAdmissionregistration_k8s_iov1beta1 = new kubernetes.admissionregistration.v1beta1.ValidatingAdmissionPolicyList("examplevalidatingAdmissionPolicyListResourceResourceFromAdmissionregistration.k8s.iov1beta1", {
        items: [{
            apiVersion: "admissionregistration.k8s.io/v1beta1",
            kind: "ValidatingAdmissionPolicy",
            metadata: {
                annotations: {
                    string: "string",
                },
                clusterName: "string",
                creationTimestamp: "string",
                deletionGracePeriodSeconds: 0,
                deletionTimestamp: "string",
                finalizers: ["string"],
                generateName: "string",
                generation: 0,
                labels: {
                    string: "string",
                },
                managedFields: [{
                    apiVersion: "string",
                    fieldsType: "string",
                    fieldsV1: "{}",
                    manager: "string",
                    operation: "string",
                    subresource: "string",
                    time: "string",
                }],
                name: "string",
                namespace: "string",
                ownerReferences: [{
                    apiVersion: "string",
                    kind: "string",
                    name: "string",
                    uid: "string",
                    blockOwnerDeletion: false,
                    controller: false,
                }],
                resourceVersion: "string",
                selfLink: "string",
                uid: "string",
            },
            spec: {
                auditAnnotations: [{
                    key: "string",
                    valueExpression: "string",
                }],
                failurePolicy: "string",
                matchConditions: [{
                    expression: "string",
                    name: "string",
                }],
                matchConstraints: {
                    excludeResourceRules: [{
                        apiGroups: ["string"],
                        apiVersions: ["string"],
                        operations: ["string"],
                        resourceNames: ["string"],
                        resources: ["string"],
                        scope: "string",
                    }],
                    matchPolicy: "string",
                    namespaceSelector: {
                        matchExpressions: [{
                            key: "string",
                            operator: "string",
                            values: ["string"],
                        }],
                        matchLabels: {
                            string: "string",
                        },
                    },
                    objectSelector: {
                        matchExpressions: [{
                            key: "string",
                            operator: "string",
                            values: ["string"],
                        }],
                        matchLabels: {
                            string: "string",
                        },
                    },
                    resourceRules: [{
                        apiGroups: ["string"],
                        apiVersions: ["string"],
                        operations: ["string"],
                        resourceNames: ["string"],
                        resources: ["string"],
                        scope: "string",
                    }],
                },
                paramKind: {
                    apiVersion: "string",
                    kind: "string",
                },
                validations: [{
                    expression: "string",
                    message: "string",
                    messageExpression: "string",
                    reason: "string",
                }],
                variables: [{
                    expression: "string",
                    name: "string",
                }],
            },
            status: {
                conditions: [{
                    lastTransitionTime: "string",
                    message: "string",
                    reason: "string",
                    status: "string",
                    type: "string",
                    observedGeneration: 0,
                }],
                observedGeneration: 0,
                typeChecking: {
                    expressionWarnings: [{
                        fieldRef: "string",
                        warning: "string",
                    }],
                },
            },
        }],
        apiVersion: "string",
        kind: "string",
        metadata: {
            "continue": "string",
            remainingItemCount: 0,
            resourceVersion: "string",
            selfLink: "string",
        },
    });
    
    type: kubernetes:admissionregistration.k8s.io/v1beta1:ValidatingAdmissionPolicyList
    properties:
        apiVersion: string
        items:
            - apiVersion: admissionregistration.k8s.io/v1beta1
              kind: ValidatingAdmissionPolicy
              metadata:
                annotations:
                    string: string
                clusterName: string
                creationTimestamp: string
                deletionGracePeriodSeconds: 0
                deletionTimestamp: string
                finalizers:
                    - string
                generateName: string
                generation: 0
                labels:
                    string: string
                managedFields:
                    - apiVersion: string
                      fieldsType: string
                      fieldsV1: '{}'
                      manager: string
                      operation: string
                      subresource: string
                      time: string
                name: string
                namespace: string
                ownerReferences:
                    - apiVersion: string
                      blockOwnerDeletion: false
                      controller: false
                      kind: string
                      name: string
                      uid: string
                resourceVersion: string
                selfLink: string
                uid: string
              spec:
                auditAnnotations:
                    - key: string
                      valueExpression: string
                failurePolicy: string
                matchConditions:
                    - expression: string
                      name: string
                matchConstraints:
                    excludeResourceRules:
                        - apiGroups:
                            - string
                          apiVersions:
                            - string
                          operations:
                            - string
                          resourceNames:
                            - string
                          resources:
                            - string
                          scope: string
                    matchPolicy: string
                    namespaceSelector:
                        matchExpressions:
                            - key: string
                              operator: string
                              values:
                                - string
                        matchLabels:
                            string: string
                    objectSelector:
                        matchExpressions:
                            - key: string
                              operator: string
                              values:
                                - string
                        matchLabels:
                            string: string
                    resourceRules:
                        - apiGroups:
                            - string
                          apiVersions:
                            - string
                          operations:
                            - string
                          resourceNames:
                            - string
                          resources:
                            - string
                          scope: string
                paramKind:
                    apiVersion: string
                    kind: string
                validations:
                    - expression: string
                      message: string
                      messageExpression: string
                      reason: string
                variables:
                    - expression: string
                      name: string
              status:
                conditions:
                    - lastTransitionTime: string
                      message: string
                      observedGeneration: 0
                      reason: string
                      status: string
                      type: string
                observedGeneration: 0
                typeChecking:
                    expressionWarnings:
                        - fieldRef: string
                          warning: string
        kind: string
        metadata:
            continue: string
            remainingItemCount: 0
            resourceVersion: string
            selfLink: string
    

    ValidatingAdmissionPolicyList Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    The ValidatingAdmissionPolicyList resource accepts the following input properties:

    Items List<ValidatingAdmissionPolicy>
    List of ValidatingAdmissionPolicy.
    Metadata Pulumi.Kubernetes.Meta.V1.Inputs.ListMeta
    Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    Items []ValidatingAdmissionPolicyTypeArgs
    List of ValidatingAdmissionPolicy.
    Metadata ListMetaArgs
    Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    items List<ValidatingAdmissionPolicy>
    List of ValidatingAdmissionPolicy.
    metadata ListMeta
    Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    items ValidatingAdmissionPolicy[]
    List of ValidatingAdmissionPolicy.
    metadata meta.v1.ListMeta
    Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    items Sequence[admissionregistration_k8s_io.v1beta1.ValidatingAdmissionPolicyArgs]
    List of ValidatingAdmissionPolicy.
    metadata meta.v1.ListMetaArgs
    Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    items List<Property Map>
    List of ValidatingAdmissionPolicy.
    metadata Property Map
    Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds

    Outputs

    All input properties are implicitly available as output properties. Additionally, the ValidatingAdmissionPolicyList resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    Id string
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id str
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.

    Supporting Types

    AuditAnnotation, AuditAnnotationArgs

    Key string

    key specifies the audit annotation key. The audit annotation keys of a ValidatingAdmissionPolicy must be unique. The key must be a qualified name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length.

    The key is combined with the resource name of the ValidatingAdmissionPolicy to construct an audit annotation key: "{ValidatingAdmissionPolicy name}/{key}".

    If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy and the same audit annotation key, the annotation key will be identical. In this case, the first annotation written with the key will be included in the audit event and all subsequent annotations with the same key will be discarded.

    Required.

    ValueExpression string

    valueExpression represents the expression which is evaluated by CEL to produce an audit annotation value. The expression must evaluate to either a string or null value. If the expression evaluates to a string, the audit annotation is included with the string value. If the expression evaluates to null or empty string the audit annotation will be omitted. The valueExpression may be no longer than 5kb in length. If the result of the valueExpression is more than 10kb in length, it will be truncated to 10kb.

    If multiple ValidatingAdmissionPolicyBinding resources match an API request, then the valueExpression will be evaluated for each binding. All unique values produced by the valueExpressions will be joined together in a comma-separated list.

    Required.

    Key string

    key specifies the audit annotation key. The audit annotation keys of a ValidatingAdmissionPolicy must be unique. The key must be a qualified name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length.

    The key is combined with the resource name of the ValidatingAdmissionPolicy to construct an audit annotation key: "{ValidatingAdmissionPolicy name}/{key}".

    If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy and the same audit annotation key, the annotation key will be identical. In this case, the first annotation written with the key will be included in the audit event and all subsequent annotations with the same key will be discarded.

    Required.

    ValueExpression string

    valueExpression represents the expression which is evaluated by CEL to produce an audit annotation value. The expression must evaluate to either a string or null value. If the expression evaluates to a string, the audit annotation is included with the string value. If the expression evaluates to null or empty string the audit annotation will be omitted. The valueExpression may be no longer than 5kb in length. If the result of the valueExpression is more than 10kb in length, it will be truncated to 10kb.

    If multiple ValidatingAdmissionPolicyBinding resources match an API request, then the valueExpression will be evaluated for each binding. All unique values produced by the valueExpressions will be joined together in a comma-separated list.

    Required.

    key String

    key specifies the audit annotation key. The audit annotation keys of a ValidatingAdmissionPolicy must be unique. The key must be a qualified name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length.

    The key is combined with the resource name of the ValidatingAdmissionPolicy to construct an audit annotation key: "{ValidatingAdmissionPolicy name}/{key}".

    If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy and the same audit annotation key, the annotation key will be identical. In this case, the first annotation written with the key will be included in the audit event and all subsequent annotations with the same key will be discarded.

    Required.

    valueExpression String

    valueExpression represents the expression which is evaluated by CEL to produce an audit annotation value. The expression must evaluate to either a string or null value. If the expression evaluates to a string, the audit annotation is included with the string value. If the expression evaluates to null or empty string the audit annotation will be omitted. The valueExpression may be no longer than 5kb in length. If the result of the valueExpression is more than 10kb in length, it will be truncated to 10kb.

    If multiple ValidatingAdmissionPolicyBinding resources match an API request, then the valueExpression will be evaluated for each binding. All unique values produced by the valueExpressions will be joined together in a comma-separated list.

    Required.

    key string

    key specifies the audit annotation key. The audit annotation keys of a ValidatingAdmissionPolicy must be unique. The key must be a qualified name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length.

    The key is combined with the resource name of the ValidatingAdmissionPolicy to construct an audit annotation key: "{ValidatingAdmissionPolicy name}/{key}".

    If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy and the same audit annotation key, the annotation key will be identical. In this case, the first annotation written with the key will be included in the audit event and all subsequent annotations with the same key will be discarded.

    Required.

    valueExpression string

    valueExpression represents the expression which is evaluated by CEL to produce an audit annotation value. The expression must evaluate to either a string or null value. If the expression evaluates to a string, the audit annotation is included with the string value. If the expression evaluates to null or empty string the audit annotation will be omitted. The valueExpression may be no longer than 5kb in length. If the result of the valueExpression is more than 10kb in length, it will be truncated to 10kb.

    If multiple ValidatingAdmissionPolicyBinding resources match an API request, then the valueExpression will be evaluated for each binding. All unique values produced by the valueExpressions will be joined together in a comma-separated list.

    Required.

    key str

    key specifies the audit annotation key. The audit annotation keys of a ValidatingAdmissionPolicy must be unique. The key must be a qualified name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length.

    The key is combined with the resource name of the ValidatingAdmissionPolicy to construct an audit annotation key: "{ValidatingAdmissionPolicy name}/{key}".

    If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy and the same audit annotation key, the annotation key will be identical. In this case, the first annotation written with the key will be included in the audit event and all subsequent annotations with the same key will be discarded.

    Required.

    value_expression str

    valueExpression represents the expression which is evaluated by CEL to produce an audit annotation value. The expression must evaluate to either a string or null value. If the expression evaluates to a string, the audit annotation is included with the string value. If the expression evaluates to null or empty string the audit annotation will be omitted. The valueExpression may be no longer than 5kb in length. If the result of the valueExpression is more than 10kb in length, it will be truncated to 10kb.

    If multiple ValidatingAdmissionPolicyBinding resources match an API request, then the valueExpression will be evaluated for each binding. All unique values produced by the valueExpressions will be joined together in a comma-separated list.

    Required.

    key String

    key specifies the audit annotation key. The audit annotation keys of a ValidatingAdmissionPolicy must be unique. The key must be a qualified name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length.

    The key is combined with the resource name of the ValidatingAdmissionPolicy to construct an audit annotation key: "{ValidatingAdmissionPolicy name}/{key}".

    If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy and the same audit annotation key, the annotation key will be identical. In this case, the first annotation written with the key will be included in the audit event and all subsequent annotations with the same key will be discarded.

    Required.

    valueExpression String

    valueExpression represents the expression which is evaluated by CEL to produce an audit annotation value. The expression must evaluate to either a string or null value. If the expression evaluates to a string, the audit annotation is included with the string value. If the expression evaluates to null or empty string the audit annotation will be omitted. The valueExpression may be no longer than 5kb in length. If the result of the valueExpression is more than 10kb in length, it will be truncated to 10kb.

    If multiple ValidatingAdmissionPolicyBinding resources match an API request, then the valueExpression will be evaluated for each binding. All unique values produced by the valueExpressions will be joined together in a comma-separated list.

    Required.

    Condition, ConditionArgs

    LastTransitionTime string
    lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
    Message string
    message is a human readable message indicating details about the transition. This may be an empty string.
    Reason string
    reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.
    Status string
    status of the condition, one of True, False, Unknown.
    Type string
    type of condition in CamelCase or in foo.example.com/CamelCase.
    ObservedGeneration int
    observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.
    LastTransitionTime string
    lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
    Message string
    message is a human readable message indicating details about the transition. This may be an empty string.
    Reason string
    reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.
    Status string
    status of the condition, one of True, False, Unknown.
    Type string
    type of condition in CamelCase or in foo.example.com/CamelCase.
    ObservedGeneration int
    observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.
    lastTransitionTime String
    lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
    message String
    message is a human readable message indicating details about the transition. This may be an empty string.
    reason String
    reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.
    status String
    status of the condition, one of True, False, Unknown.
    type String
    type of condition in CamelCase or in foo.example.com/CamelCase.
    observedGeneration Integer
    observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.
    lastTransitionTime string
    lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
    message string
    message is a human readable message indicating details about the transition. This may be an empty string.
    reason string
    reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.
    status string
    status of the condition, one of True, False, Unknown.
    type string
    type of condition in CamelCase or in foo.example.com/CamelCase.
    observedGeneration number
    observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.
    last_transition_time str
    lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
    message str
    message is a human readable message indicating details about the transition. This may be an empty string.
    reason str
    reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.
    status str
    status of the condition, one of True, False, Unknown.
    type str
    type of condition in CamelCase or in foo.example.com/CamelCase.
    observed_generation int
    observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.
    lastTransitionTime String
    lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
    message String
    message is a human readable message indicating details about the transition. This may be an empty string.
    reason String
    reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.
    status String
    status of the condition, one of True, False, Unknown.
    type String
    type of condition in CamelCase or in foo.example.com/CamelCase.
    observedGeneration Number
    observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.

    ExpressionWarning, ExpressionWarningArgs

    FieldRef string
    The path to the field that refers the expression. For example, the reference to the expression of the first item of validations is "spec.validations[0].expression"
    Warning string
    The content of type checking information in a human-readable form. Each line of the warning contains the type that the expression is checked against, followed by the type check error from the compiler.
    FieldRef string
    The path to the field that refers the expression. For example, the reference to the expression of the first item of validations is "spec.validations[0].expression"
    Warning string
    The content of type checking information in a human-readable form. Each line of the warning contains the type that the expression is checked against, followed by the type check error from the compiler.
    fieldRef String
    The path to the field that refers the expression. For example, the reference to the expression of the first item of validations is "spec.validations[0].expression"
    warning String
    The content of type checking information in a human-readable form. Each line of the warning contains the type that the expression is checked against, followed by the type check error from the compiler.
    fieldRef string
    The path to the field that refers the expression. For example, the reference to the expression of the first item of validations is "spec.validations[0].expression"
    warning string
    The content of type checking information in a human-readable form. Each line of the warning contains the type that the expression is checked against, followed by the type check error from the compiler.
    field_ref str
    The path to the field that refers the expression. For example, the reference to the expression of the first item of validations is "spec.validations[0].expression"
    warning str
    The content of type checking information in a human-readable form. Each line of the warning contains the type that the expression is checked against, followed by the type check error from the compiler.
    fieldRef String
    The path to the field that refers the expression. For example, the reference to the expression of the first item of validations is "spec.validations[0].expression"
    warning String
    The content of type checking information in a human-readable form. Each line of the warning contains the type that the expression is checked against, followed by the type check error from the compiler.

    LabelSelector, LabelSelectorArgs

    MatchExpressions List<Pulumi.Kubernetes.Meta.V1.Inputs.LabelSelectorRequirement>
    matchExpressions is a list of label selector requirements. The requirements are ANDed.
    MatchLabels Dictionary<string, string>
    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
    MatchExpressions LabelSelectorRequirement
    matchExpressions is a list of label selector requirements. The requirements are ANDed.
    MatchLabels map[string]string
    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
    matchExpressions List<LabelSelectorRequirement>
    matchExpressions is a list of label selector requirements. The requirements are ANDed.
    matchLabels Map<String,String>
    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
    matchExpressions meta.v1.LabelSelectorRequirement[]
    matchExpressions is a list of label selector requirements. The requirements are ANDed.
    matchLabels {[key: string]: string}
    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
    match_expressions Sequence[meta.v1.LabelSelectorRequirement]
    matchExpressions is a list of label selector requirements. The requirements are ANDed.
    match_labels Mapping[str, str]
    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
    matchExpressions List<Property Map>
    matchExpressions is a list of label selector requirements. The requirements are ANDed.
    matchLabels Map<String>
    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.

    LabelSelectorRequirement, LabelSelectorRequirementArgs

    Key string
    key is the label key that the selector applies to.
    Operator string
    operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
    Values List<string>
    values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
    Key string
    key is the label key that the selector applies to.
    Operator string
    operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
    Values []string
    values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
    key String
    key is the label key that the selector applies to.
    operator String
    operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
    values List<String>
    values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
    key string
    key is the label key that the selector applies to.
    operator string
    operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
    values string[]
    values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
    key str
    key is the label key that the selector applies to.
    operator str
    operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
    values Sequence[str]
    values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
    key String
    key is the label key that the selector applies to.
    operator String
    operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
    values List<String>
    values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.

    ListMeta, ListMetaArgs

    Continue string
    continue may be set if the user set a limit on the number of items returned, and indicates that the server has more data available. The value is opaque and may be used to issue another request to the endpoint that served this list to retrieve the next set of available objects. Continuing a consistent list may not be possible if the server configuration has changed or more than a few minutes have passed. The resourceVersion field returned when using this continue value will be identical to the value in the first response, unless you have received this token from an error message.
    RemainingItemCount int
    remainingItemCount is the number of subsequent items in the list which are not included in this list response. If the list request contained label or field selectors, then the number of remaining items is unknown and the field will be left unset and omitted during serialization. If the list is complete (either because it is not chunking or because this is the last chunk), then there are no more remaining items and this field will be left unset and omitted during serialization. Servers older than v1.15 do not set this field. The intended use of the remainingItemCount is estimating the size of a collection. Clients should not rely on the remainingItemCount to be set or to be exact.
    ResourceVersion string
    String that identifies the server's internal version of this object that can be used by clients to determine when objects have changed. Value must be treated as opaque by clients and passed unmodified back to the server. Populated by the system. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency
    SelfLink string
    Deprecated: selfLink is a legacy read-only field that is no longer populated by the system.
    Continue string
    continue may be set if the user set a limit on the number of items returned, and indicates that the server has more data available. The value is opaque and may be used to issue another request to the endpoint that served this list to retrieve the next set of available objects. Continuing a consistent list may not be possible if the server configuration has changed or more than a few minutes have passed. The resourceVersion field returned when using this continue value will be identical to the value in the first response, unless you have received this token from an error message.
    RemainingItemCount int
    remainingItemCount is the number of subsequent items in the list which are not included in this list response. If the list request contained label or field selectors, then the number of remaining items is unknown and the field will be left unset and omitted during serialization. If the list is complete (either because it is not chunking or because this is the last chunk), then there are no more remaining items and this field will be left unset and omitted during serialization. Servers older than v1.15 do not set this field. The intended use of the remainingItemCount is estimating the size of a collection. Clients should not rely on the remainingItemCount to be set or to be exact.
    ResourceVersion string
    String that identifies the server's internal version of this object that can be used by clients to determine when objects have changed. Value must be treated as opaque by clients and passed unmodified back to the server. Populated by the system. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency
    SelfLink string
    Deprecated: selfLink is a legacy read-only field that is no longer populated by the system.
    continue_ String
    continue may be set if the user set a limit on the number of items returned, and indicates that the server has more data available. The value is opaque and may be used to issue another request to the endpoint that served this list to retrieve the next set of available objects. Continuing a consistent list may not be possible if the server configuration has changed or more than a few minutes have passed. The resourceVersion field returned when using this continue value will be identical to the value in the first response, unless you have received this token from an error message.
    remainingItemCount Integer
    remainingItemCount is the number of subsequent items in the list which are not included in this list response. If the list request contained label or field selectors, then the number of remaining items is unknown and the field will be left unset and omitted during serialization. If the list is complete (either because it is not chunking or because this is the last chunk), then there are no more remaining items and this field will be left unset and omitted during serialization. Servers older than v1.15 do not set this field. The intended use of the remainingItemCount is estimating the size of a collection. Clients should not rely on the remainingItemCount to be set or to be exact.
    resourceVersion String
    String that identifies the server's internal version of this object that can be used by clients to determine when objects have changed. Value must be treated as opaque by clients and passed unmodified back to the server. Populated by the system. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency
    selfLink String
    Deprecated: selfLink is a legacy read-only field that is no longer populated by the system.
    continue string
    continue may be set if the user set a limit on the number of items returned, and indicates that the server has more data available. The value is opaque and may be used to issue another request to the endpoint that served this list to retrieve the next set of available objects. Continuing a consistent list may not be possible if the server configuration has changed or more than a few minutes have passed. The resourceVersion field returned when using this continue value will be identical to the value in the first response, unless you have received this token from an error message.
    remainingItemCount number
    remainingItemCount is the number of subsequent items in the list which are not included in this list response. If the list request contained label or field selectors, then the number of remaining items is unknown and the field will be left unset and omitted during serialization. If the list is complete (either because it is not chunking or because this is the last chunk), then there are no more remaining items and this field will be left unset and omitted during serialization. Servers older than v1.15 do not set this field. The intended use of the remainingItemCount is estimating the size of a collection. Clients should not rely on the remainingItemCount to be set or to be exact.
    resourceVersion string
    String that identifies the server's internal version of this object that can be used by clients to determine when objects have changed. Value must be treated as opaque by clients and passed unmodified back to the server. Populated by the system. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency
    selfLink string
    Deprecated: selfLink is a legacy read-only field that is no longer populated by the system.
    continue_ str
    continue may be set if the user set a limit on the number of items returned, and indicates that the server has more data available. The value is opaque and may be used to issue another request to the endpoint that served this list to retrieve the next set of available objects. Continuing a consistent list may not be possible if the server configuration has changed or more than a few minutes have passed. The resourceVersion field returned when using this continue value will be identical to the value in the first response, unless you have received this token from an error message.
    remaining_item_count int
    remainingItemCount is the number of subsequent items in the list which are not included in this list response. If the list request contained label or field selectors, then the number of remaining items is unknown and the field will be left unset and omitted during serialization. If the list is complete (either because it is not chunking or because this is the last chunk), then there are no more remaining items and this field will be left unset and omitted during serialization. Servers older than v1.15 do not set this field. The intended use of the remainingItemCount is estimating the size of a collection. Clients should not rely on the remainingItemCount to be set or to be exact.
    resource_version str
    String that identifies the server's internal version of this object that can be used by clients to determine when objects have changed. Value must be treated as opaque by clients and passed unmodified back to the server. Populated by the system. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency
    self_link str
    Deprecated: selfLink is a legacy read-only field that is no longer populated by the system.
    continue String
    continue may be set if the user set a limit on the number of items returned, and indicates that the server has more data available. The value is opaque and may be used to issue another request to the endpoint that served this list to retrieve the next set of available objects. Continuing a consistent list may not be possible if the server configuration has changed or more than a few minutes have passed. The resourceVersion field returned when using this continue value will be identical to the value in the first response, unless you have received this token from an error message.
    remainingItemCount Number
    remainingItemCount is the number of subsequent items in the list which are not included in this list response. If the list request contained label or field selectors, then the number of remaining items is unknown and the field will be left unset and omitted during serialization. If the list is complete (either because it is not chunking or because this is the last chunk), then there are no more remaining items and this field will be left unset and omitted during serialization. Servers older than v1.15 do not set this field. The intended use of the remainingItemCount is estimating the size of a collection. Clients should not rely on the remainingItemCount to be set or to be exact.
    resourceVersion String
    String that identifies the server's internal version of this object that can be used by clients to determine when objects have changed. Value must be treated as opaque by clients and passed unmodified back to the server. Populated by the system. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency
    selfLink String
    Deprecated: selfLink is a legacy read-only field that is no longer populated by the system.

    ManagedFieldsEntry, ManagedFieldsEntryArgs

    ApiVersion string
    APIVersion defines the version of this resource that this field set applies to. The format is "group/version" just like the top-level APIVersion field. It is necessary to track the version of a field set because it cannot be automatically converted.
    FieldsType string
    FieldsType is the discriminator for the different fields format and version. There is currently only one possible value: "FieldsV1"
    FieldsV1 System.Text.Json.JsonElement
    FieldsV1 holds the first JSON version format as described in the "FieldsV1" type.
    Manager string
    Manager is an identifier of the workflow managing these fields.
    Operation string
    Operation is the type of operation which lead to this ManagedFieldsEntry being created. The only valid values for this field are 'Apply' and 'Update'.
    Subresource string
    Subresource is the name of the subresource used to update that object, or empty string if the object was updated through the main resource. The value of this field is used to distinguish between managers, even if they share the same name. For example, a status update will be distinct from a regular update using the same manager name. Note that the APIVersion field is not related to the Subresource field and it always corresponds to the version of the main resource.
    Time string
    Time is the timestamp of when the ManagedFields entry was added. The timestamp will also be updated if a field is added, the manager changes any of the owned fields value or removes a field. The timestamp does not update when a field is removed from the entry because another manager took it over.
    ApiVersion string
    APIVersion defines the version of this resource that this field set applies to. The format is "group/version" just like the top-level APIVersion field. It is necessary to track the version of a field set because it cannot be automatically converted.
    FieldsType string
    FieldsType is the discriminator for the different fields format and version. There is currently only one possible value: "FieldsV1"
    FieldsV1 interface{}
    FieldsV1 holds the first JSON version format as described in the "FieldsV1" type.
    Manager string
    Manager is an identifier of the workflow managing these fields.
    Operation string
    Operation is the type of operation which lead to this ManagedFieldsEntry being created. The only valid values for this field are 'Apply' and 'Update'.
    Subresource string
    Subresource is the name of the subresource used to update that object, or empty string if the object was updated through the main resource. The value of this field is used to distinguish between managers, even if they share the same name. For example, a status update will be distinct from a regular update using the same manager name. Note that the APIVersion field is not related to the Subresource field and it always corresponds to the version of the main resource.
    Time string
    Time is the timestamp of when the ManagedFields entry was added. The timestamp will also be updated if a field is added, the manager changes any of the owned fields value or removes a field. The timestamp does not update when a field is removed from the entry because another manager took it over.
    apiVersion String
    APIVersion defines the version of this resource that this field set applies to. The format is "group/version" just like the top-level APIVersion field. It is necessary to track the version of a field set because it cannot be automatically converted.
    fieldsType String
    FieldsType is the discriminator for the different fields format and version. There is currently only one possible value: "FieldsV1"
    fieldsV1 JsonElement
    FieldsV1 holds the first JSON version format as described in the "FieldsV1" type.
    manager String
    Manager is an identifier of the workflow managing these fields.
    operation String
    Operation is the type of operation which lead to this ManagedFieldsEntry being created. The only valid values for this field are 'Apply' and 'Update'.
    subresource String
    Subresource is the name of the subresource used to update that object, or empty string if the object was updated through the main resource. The value of this field is used to distinguish between managers, even if they share the same name. For example, a status update will be distinct from a regular update using the same manager name. Note that the APIVersion field is not related to the Subresource field and it always corresponds to the version of the main resource.
    time String
    Time is the timestamp of when the ManagedFields entry was added. The timestamp will also be updated if a field is added, the manager changes any of the owned fields value or removes a field. The timestamp does not update when a field is removed from the entry because another manager took it over.
    apiVersion string
    APIVersion defines the version of this resource that this field set applies to. The format is "group/version" just like the top-level APIVersion field. It is necessary to track the version of a field set because it cannot be automatically converted.
    fieldsType string
    FieldsType is the discriminator for the different fields format and version. There is currently only one possible value: "FieldsV1"
    fieldsV1 any
    FieldsV1 holds the first JSON version format as described in the "FieldsV1" type.
    manager string
    Manager is an identifier of the workflow managing these fields.
    operation string
    Operation is the type of operation which lead to this ManagedFieldsEntry being created. The only valid values for this field are 'Apply' and 'Update'.
    subresource string
    Subresource is the name of the subresource used to update that object, or empty string if the object was updated through the main resource. The value of this field is used to distinguish between managers, even if they share the same name. For example, a status update will be distinct from a regular update using the same manager name. Note that the APIVersion field is not related to the Subresource field and it always corresponds to the version of the main resource.
    time string
    Time is the timestamp of when the ManagedFields entry was added. The timestamp will also be updated if a field is added, the manager changes any of the owned fields value or removes a field. The timestamp does not update when a field is removed from the entry because another manager took it over.
    api_version str
    APIVersion defines the version of this resource that this field set applies to. The format is "group/version" just like the top-level APIVersion field. It is necessary to track the version of a field set because it cannot be automatically converted.
    fields_type str
    FieldsType is the discriminator for the different fields format and version. There is currently only one possible value: "FieldsV1"
    fields_v1 Any
    FieldsV1 holds the first JSON version format as described in the "FieldsV1" type.
    manager str
    Manager is an identifier of the workflow managing these fields.
    operation str
    Operation is the type of operation which lead to this ManagedFieldsEntry being created. The only valid values for this field are 'Apply' and 'Update'.
    subresource str
    Subresource is the name of the subresource used to update that object, or empty string if the object was updated through the main resource. The value of this field is used to distinguish between managers, even if they share the same name. For example, a status update will be distinct from a regular update using the same manager name. Note that the APIVersion field is not related to the Subresource field and it always corresponds to the version of the main resource.
    time str
    Time is the timestamp of when the ManagedFields entry was added. The timestamp will also be updated if a field is added, the manager changes any of the owned fields value or removes a field. The timestamp does not update when a field is removed from the entry because another manager took it over.
    apiVersion String
    APIVersion defines the version of this resource that this field set applies to. The format is "group/version" just like the top-level APIVersion field. It is necessary to track the version of a field set because it cannot be automatically converted.
    fieldsType String
    FieldsType is the discriminator for the different fields format and version. There is currently only one possible value: "FieldsV1"
    fieldsV1 JSON
    FieldsV1 holds the first JSON version format as described in the "FieldsV1" type.
    manager String
    Manager is an identifier of the workflow managing these fields.
    operation String
    Operation is the type of operation which lead to this ManagedFieldsEntry being created. The only valid values for this field are 'Apply' and 'Update'.
    subresource String
    Subresource is the name of the subresource used to update that object, or empty string if the object was updated through the main resource. The value of this field is used to distinguish between managers, even if they share the same name. For example, a status update will be distinct from a regular update using the same manager name. Note that the APIVersion field is not related to the Subresource field and it always corresponds to the version of the main resource.
    time String
    Time is the timestamp of when the ManagedFields entry was added. The timestamp will also be updated if a field is added, the manager changes any of the owned fields value or removes a field. The timestamp does not update when a field is removed from the entry because another manager took it over.

    MatchCondition, MatchConditionArgs

    Expression string

    Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables:

    'object' - The object from the incoming request. The value is null for DELETE requests. 'oldObject' - The existing object. The value is null for CREATE requests. 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the request resource. Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/

    Required.

    Name string

    Name is an identifier for this match condition, used for strategic merging of MatchConditions, as well as providing an identifier for logging purposes. A good name should be descriptive of the associated expression. Name must be a qualified name consisting of alphanumeric characters, '-', '' or '.', and must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9.]*)?[A-Za-z0-9]') with an optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName')

    Required.

    Expression string

    Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables:

    'object' - The object from the incoming request. The value is null for DELETE requests. 'oldObject' - The existing object. The value is null for CREATE requests. 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the request resource. Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/

    Required.

    Name string

    Name is an identifier for this match condition, used for strategic merging of MatchConditions, as well as providing an identifier for logging purposes. A good name should be descriptive of the associated expression. Name must be a qualified name consisting of alphanumeric characters, '-', '' or '.', and must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9.]*)?[A-Za-z0-9]') with an optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName')

    Required.

    expression String

    Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables:

    'object' - The object from the incoming request. The value is null for DELETE requests. 'oldObject' - The existing object. The value is null for CREATE requests. 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the request resource. Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/

    Required.

    name String

    Name is an identifier for this match condition, used for strategic merging of MatchConditions, as well as providing an identifier for logging purposes. A good name should be descriptive of the associated expression. Name must be a qualified name consisting of alphanumeric characters, '-', '' or '.', and must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9.]*)?[A-Za-z0-9]') with an optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName')

    Required.

    expression string

    Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables:

    'object' - The object from the incoming request. The value is null for DELETE requests. 'oldObject' - The existing object. The value is null for CREATE requests. 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the request resource. Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/

    Required.

    name string

    Name is an identifier for this match condition, used for strategic merging of MatchConditions, as well as providing an identifier for logging purposes. A good name should be descriptive of the associated expression. Name must be a qualified name consisting of alphanumeric characters, '-', '' or '.', and must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9.]*)?[A-Za-z0-9]') with an optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName')

    Required.

    expression str

    Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables:

    'object' - The object from the incoming request. The value is null for DELETE requests. 'oldObject' - The existing object. The value is null for CREATE requests. 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the request resource. Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/

    Required.

    name str

    Name is an identifier for this match condition, used for strategic merging of MatchConditions, as well as providing an identifier for logging purposes. A good name should be descriptive of the associated expression. Name must be a qualified name consisting of alphanumeric characters, '-', '' or '.', and must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9.]*)?[A-Za-z0-9]') with an optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName')

    Required.

    expression String

    Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables:

    'object' - The object from the incoming request. The value is null for DELETE requests. 'oldObject' - The existing object. The value is null for CREATE requests. 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the request resource. Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/

    Required.

    name String

    Name is an identifier for this match condition, used for strategic merging of MatchConditions, as well as providing an identifier for logging purposes. A good name should be descriptive of the associated expression. Name must be a qualified name consisting of alphanumeric characters, '-', '' or '.', and must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9.]*)?[A-Za-z0-9]') with an optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName')

    Required.

    MatchResources, MatchResourcesArgs

    ExcludeResourceRules List<NamedRuleWithOperations>
    ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. The exclude rules take precedence over include rules (if a resource matches both, it is excluded)
    MatchPolicy string

    matchPolicy defines how the "MatchResources" list is used to match incoming requests. Allowed values are "Exact" or "Equivalent".

    • Exact: match a request only if it exactly matches a specified rule. For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, but "rules" only included apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"], a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy.

    • Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, and "rules" only included apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"], a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy.

    Defaults to "Equivalent"

    NamespaceSelector Pulumi.Kubernetes.Meta.V1.Inputs.LabelSelector

    NamespaceSelector decides whether to run the admission control policy on an object based on whether the namespace for that object matches the selector. If the object itself is a namespace, the matching is performed on object.metadata.labels. If the object is another cluster scoped resource, it never skips the policy.

    For example, to run the webhook on any objects whose namespace is not associated with "runlevel" of "0" or "1"; you will set the selector as follows: "namespaceSelector": { "matchExpressions": [ { "key": "runlevel", "operator": "NotIn", "values": [ "0", "1" ] } ] }

    If instead you want to only run the policy on any objects whose namespace is associated with the "environment" of "prod" or "staging"; you will set the selector as follows: "namespaceSelector": { "matchExpressions": [ { "key": "environment", "operator": "In", "values": [ "prod", "staging" ] } ] }

    See https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ for more examples of label selectors.

    Default to the empty LabelSelector, which matches everything.

    ObjectSelector Pulumi.Kubernetes.Meta.V1.Inputs.LabelSelector
    ObjectSelector decides whether to run the validation based on if the object has matching labels. objectSelector is evaluated against both the oldObject and newObject that would be sent to the cel validation, and is considered to match if either object matches the selector. A null object (oldObject in the case of create, or newObject in the case of delete) or an object that cannot have labels (like a DeploymentRollback or a PodProxyOptions object) is not considered to match. Use the object selector only if the webhook is opt-in, because end users may skip the admission webhook by setting the labels. Default to the empty LabelSelector, which matches everything.
    ResourceRules List<NamedRuleWithOperations>
    ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. The policy cares about an operation if it matches any Rule.
    ExcludeResourceRules []NamedRuleWithOperations
    ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. The exclude rules take precedence over include rules (if a resource matches both, it is excluded)
    MatchPolicy string

    matchPolicy defines how the "MatchResources" list is used to match incoming requests. Allowed values are "Exact" or "Equivalent".

    • Exact: match a request only if it exactly matches a specified rule. For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, but "rules" only included apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"], a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy.

    • Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, and "rules" only included apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"], a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy.

    Defaults to "Equivalent"

    NamespaceSelector LabelSelector

    NamespaceSelector decides whether to run the admission control policy on an object based on whether the namespace for that object matches the selector. If the object itself is a namespace, the matching is performed on object.metadata.labels. If the object is another cluster scoped resource, it never skips the policy.

    For example, to run the webhook on any objects whose namespace is not associated with "runlevel" of "0" or "1"; you will set the selector as follows: "namespaceSelector": { "matchExpressions": [ { "key": "runlevel", "operator": "NotIn", "values": [ "0", "1" ] } ] }

    If instead you want to only run the policy on any objects whose namespace is associated with the "environment" of "prod" or "staging"; you will set the selector as follows: "namespaceSelector": { "matchExpressions": [ { "key": "environment", "operator": "In", "values": [ "prod", "staging" ] } ] }

    See https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ for more examples of label selectors.

    Default to the empty LabelSelector, which matches everything.

    ObjectSelector LabelSelector
    ObjectSelector decides whether to run the validation based on if the object has matching labels. objectSelector is evaluated against both the oldObject and newObject that would be sent to the cel validation, and is considered to match if either object matches the selector. A null object (oldObject in the case of create, or newObject in the case of delete) or an object that cannot have labels (like a DeploymentRollback or a PodProxyOptions object) is not considered to match. Use the object selector only if the webhook is opt-in, because end users may skip the admission webhook by setting the labels. Default to the empty LabelSelector, which matches everything.
    ResourceRules []NamedRuleWithOperations
    ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. The policy cares about an operation if it matches any Rule.
    excludeResourceRules List<NamedRuleWithOperations>
    ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. The exclude rules take precedence over include rules (if a resource matches both, it is excluded)
    matchPolicy String

    matchPolicy defines how the "MatchResources" list is used to match incoming requests. Allowed values are "Exact" or "Equivalent".

    • Exact: match a request only if it exactly matches a specified rule. For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, but "rules" only included apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"], a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy.

    • Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, and "rules" only included apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"], a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy.

    Defaults to "Equivalent"

    namespaceSelector LabelSelector

    NamespaceSelector decides whether to run the admission control policy on an object based on whether the namespace for that object matches the selector. If the object itself is a namespace, the matching is performed on object.metadata.labels. If the object is another cluster scoped resource, it never skips the policy.

    For example, to run the webhook on any objects whose namespace is not associated with "runlevel" of "0" or "1"; you will set the selector as follows: "namespaceSelector": { "matchExpressions": [ { "key": "runlevel", "operator": "NotIn", "values": [ "0", "1" ] } ] }

    If instead you want to only run the policy on any objects whose namespace is associated with the "environment" of "prod" or "staging"; you will set the selector as follows: "namespaceSelector": { "matchExpressions": [ { "key": "environment", "operator": "In", "values": [ "prod", "staging" ] } ] }

    See https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ for more examples of label selectors.

    Default to the empty LabelSelector, which matches everything.

    objectSelector LabelSelector
    ObjectSelector decides whether to run the validation based on if the object has matching labels. objectSelector is evaluated against both the oldObject and newObject that would be sent to the cel validation, and is considered to match if either object matches the selector. A null object (oldObject in the case of create, or newObject in the case of delete) or an object that cannot have labels (like a DeploymentRollback or a PodProxyOptions object) is not considered to match. Use the object selector only if the webhook is opt-in, because end users may skip the admission webhook by setting the labels. Default to the empty LabelSelector, which matches everything.
    resourceRules List<NamedRuleWithOperations>
    ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. The policy cares about an operation if it matches any Rule.
    excludeResourceRules NamedRuleWithOperations[]
    ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. The exclude rules take precedence over include rules (if a resource matches both, it is excluded)
    matchPolicy string

    matchPolicy defines how the "MatchResources" list is used to match incoming requests. Allowed values are "Exact" or "Equivalent".

    • Exact: match a request only if it exactly matches a specified rule. For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, but "rules" only included apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"], a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy.

    • Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, and "rules" only included apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"], a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy.

    Defaults to "Equivalent"

    namespaceSelector meta.v1.LabelSelector

    NamespaceSelector decides whether to run the admission control policy on an object based on whether the namespace for that object matches the selector. If the object itself is a namespace, the matching is performed on object.metadata.labels. If the object is another cluster scoped resource, it never skips the policy.

    For example, to run the webhook on any objects whose namespace is not associated with "runlevel" of "0" or "1"; you will set the selector as follows: "namespaceSelector": { "matchExpressions": [ { "key": "runlevel", "operator": "NotIn", "values": [ "0", "1" ] } ] }

    If instead you want to only run the policy on any objects whose namespace is associated with the "environment" of "prod" or "staging"; you will set the selector as follows: "namespaceSelector": { "matchExpressions": [ { "key": "environment", "operator": "In", "values": [ "prod", "staging" ] } ] }

    See https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ for more examples of label selectors.

    Default to the empty LabelSelector, which matches everything.

    objectSelector meta.v1.LabelSelector
    ObjectSelector decides whether to run the validation based on if the object has matching labels. objectSelector is evaluated against both the oldObject and newObject that would be sent to the cel validation, and is considered to match if either object matches the selector. A null object (oldObject in the case of create, or newObject in the case of delete) or an object that cannot have labels (like a DeploymentRollback or a PodProxyOptions object) is not considered to match. Use the object selector only if the webhook is opt-in, because end users may skip the admission webhook by setting the labels. Default to the empty LabelSelector, which matches everything.
    resourceRules NamedRuleWithOperations[]
    ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. The policy cares about an operation if it matches any Rule.
    exclude_resource_rules Sequence[admissionregistration_k8s_io.v1beta1.NamedRuleWithOperations]
    ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. The exclude rules take precedence over include rules (if a resource matches both, it is excluded)
    match_policy str

    matchPolicy defines how the "MatchResources" list is used to match incoming requests. Allowed values are "Exact" or "Equivalent".

    • Exact: match a request only if it exactly matches a specified rule. For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, but "rules" only included apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"], a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy.

    • Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, and "rules" only included apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"], a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy.

    Defaults to "Equivalent"

    namespace_selector meta.v1.LabelSelector

    NamespaceSelector decides whether to run the admission control policy on an object based on whether the namespace for that object matches the selector. If the object itself is a namespace, the matching is performed on object.metadata.labels. If the object is another cluster scoped resource, it never skips the policy.

    For example, to run the webhook on any objects whose namespace is not associated with "runlevel" of "0" or "1"; you will set the selector as follows: "namespaceSelector": { "matchExpressions": [ { "key": "runlevel", "operator": "NotIn", "values": [ "0", "1" ] } ] }

    If instead you want to only run the policy on any objects whose namespace is associated with the "environment" of "prod" or "staging"; you will set the selector as follows: "namespaceSelector": { "matchExpressions": [ { "key": "environment", "operator": "In", "values": [ "prod", "staging" ] } ] }

    See https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ for more examples of label selectors.

    Default to the empty LabelSelector, which matches everything.

    object_selector meta.v1.LabelSelector
    ObjectSelector decides whether to run the validation based on if the object has matching labels. objectSelector is evaluated against both the oldObject and newObject that would be sent to the cel validation, and is considered to match if either object matches the selector. A null object (oldObject in the case of create, or newObject in the case of delete) or an object that cannot have labels (like a DeploymentRollback or a PodProxyOptions object) is not considered to match. Use the object selector only if the webhook is opt-in, because end users may skip the admission webhook by setting the labels. Default to the empty LabelSelector, which matches everything.
    resource_rules Sequence[admissionregistration_k8s_io.v1beta1.NamedRuleWithOperations]
    ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. The policy cares about an operation if it matches any Rule.
    excludeResourceRules List<Property Map>
    ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. The exclude rules take precedence over include rules (if a resource matches both, it is excluded)
    matchPolicy String

    matchPolicy defines how the "MatchResources" list is used to match incoming requests. Allowed values are "Exact" or "Equivalent".

    • Exact: match a request only if it exactly matches a specified rule. For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, but "rules" only included apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"], a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy.

    • Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, and "rules" only included apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"], a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy.

    Defaults to "Equivalent"

    namespaceSelector Property Map

    NamespaceSelector decides whether to run the admission control policy on an object based on whether the namespace for that object matches the selector. If the object itself is a namespace, the matching is performed on object.metadata.labels. If the object is another cluster scoped resource, it never skips the policy.

    For example, to run the webhook on any objects whose namespace is not associated with "runlevel" of "0" or "1"; you will set the selector as follows: "namespaceSelector": { "matchExpressions": [ { "key": "runlevel", "operator": "NotIn", "values": [ "0", "1" ] } ] }

    If instead you want to only run the policy on any objects whose namespace is associated with the "environment" of "prod" or "staging"; you will set the selector as follows: "namespaceSelector": { "matchExpressions": [ { "key": "environment", "operator": "In", "values": [ "prod", "staging" ] } ] }

    See https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ for more examples of label selectors.

    Default to the empty LabelSelector, which matches everything.

    objectSelector Property Map
    ObjectSelector decides whether to run the validation based on if the object has matching labels. objectSelector is evaluated against both the oldObject and newObject that would be sent to the cel validation, and is considered to match if either object matches the selector. A null object (oldObject in the case of create, or newObject in the case of delete) or an object that cannot have labels (like a DeploymentRollback or a PodProxyOptions object) is not considered to match. Use the object selector only if the webhook is opt-in, because end users may skip the admission webhook by setting the labels. Default to the empty LabelSelector, which matches everything.
    resourceRules List<Property Map>
    ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. The policy cares about an operation if it matches any Rule.

    NamedRuleWithOperations, NamedRuleWithOperationsArgs

    ApiGroups List<string>
    APIGroups is the API groups the resources belong to. '' is all groups. If '' is present, the length of the slice must be one. Required.
    ApiVersions List<string>
    APIVersions is the API versions the resources belong to. '' is all versions. If '' is present, the length of the slice must be one. Required.
    Operations List<string>
    Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * for all of those operations and any future admission operations that are added. If '*' is present, the length of the slice must be one. Required.
    ResourceNames List<string>
    ResourceNames is an optional white list of names that the rule applies to. An empty set means that everything is allowed.
    Resources List<string>

    Resources is a list of resources this rule applies to.

    For example: 'pods' means pods. 'pods/log' means the log subresource of pods. '' means all resources, but not subresources. 'pods/' means all subresources of pods. '/scale' means all scale subresources. '/*' means all resources and their subresources.

    If wildcard is present, the validation rule will ensure resources do not overlap with each other.

    Depending on the enclosing object, subresources might not be allowed. Required.

    Scope string
    scope specifies the scope of this rule. Valid values are "Cluster", "Namespaced", and "" "Cluster" means that only cluster-scoped resources will match this rule. Namespace API objects are cluster-scoped. "Namespaced" means that only namespaced resources will match this rule. "" means that there are no scope restrictions. Subresources match the scope of their parent resource. Default is "*".
    ApiGroups []string
    APIGroups is the API groups the resources belong to. '' is all groups. If '' is present, the length of the slice must be one. Required.
    ApiVersions []string
    APIVersions is the API versions the resources belong to. '' is all versions. If '' is present, the length of the slice must be one. Required.
    Operations []string
    Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * for all of those operations and any future admission operations that are added. If '*' is present, the length of the slice must be one. Required.
    ResourceNames []string
    ResourceNames is an optional white list of names that the rule applies to. An empty set means that everything is allowed.
    Resources []string

    Resources is a list of resources this rule applies to.

    For example: 'pods' means pods. 'pods/log' means the log subresource of pods. '' means all resources, but not subresources. 'pods/' means all subresources of pods. '/scale' means all scale subresources. '/*' means all resources and their subresources.

    If wildcard is present, the validation rule will ensure resources do not overlap with each other.

    Depending on the enclosing object, subresources might not be allowed. Required.

    Scope string
    scope specifies the scope of this rule. Valid values are "Cluster", "Namespaced", and "" "Cluster" means that only cluster-scoped resources will match this rule. Namespace API objects are cluster-scoped. "Namespaced" means that only namespaced resources will match this rule. "" means that there are no scope restrictions. Subresources match the scope of their parent resource. Default is "*".
    apiGroups List<String>
    APIGroups is the API groups the resources belong to. '' is all groups. If '' is present, the length of the slice must be one. Required.
    apiVersions List<String>
    APIVersions is the API versions the resources belong to. '' is all versions. If '' is present, the length of the slice must be one. Required.
    operations List<String>
    Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * for all of those operations and any future admission operations that are added. If '*' is present, the length of the slice must be one. Required.
    resourceNames List<String>
    ResourceNames is an optional white list of names that the rule applies to. An empty set means that everything is allowed.
    resources List<String>

    Resources is a list of resources this rule applies to.

    For example: 'pods' means pods. 'pods/log' means the log subresource of pods. '' means all resources, but not subresources. 'pods/' means all subresources of pods. '/scale' means all scale subresources. '/*' means all resources and their subresources.

    If wildcard is present, the validation rule will ensure resources do not overlap with each other.

    Depending on the enclosing object, subresources might not be allowed. Required.

    scope String
    scope specifies the scope of this rule. Valid values are "Cluster", "Namespaced", and "" "Cluster" means that only cluster-scoped resources will match this rule. Namespace API objects are cluster-scoped. "Namespaced" means that only namespaced resources will match this rule. "" means that there are no scope restrictions. Subresources match the scope of their parent resource. Default is "*".
    apiGroups string[]
    APIGroups is the API groups the resources belong to. '' is all groups. If '' is present, the length of the slice must be one. Required.
    apiVersions string[]
    APIVersions is the API versions the resources belong to. '' is all versions. If '' is present, the length of the slice must be one. Required.
    operations string[]
    Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * for all of those operations and any future admission operations that are added. If '*' is present, the length of the slice must be one. Required.
    resourceNames string[]
    ResourceNames is an optional white list of names that the rule applies to. An empty set means that everything is allowed.
    resources string[]

    Resources is a list of resources this rule applies to.

    For example: 'pods' means pods. 'pods/log' means the log subresource of pods. '' means all resources, but not subresources. 'pods/' means all subresources of pods. '/scale' means all scale subresources. '/*' means all resources and their subresources.

    If wildcard is present, the validation rule will ensure resources do not overlap with each other.

    Depending on the enclosing object, subresources might not be allowed. Required.

    scope string
    scope specifies the scope of this rule. Valid values are "Cluster", "Namespaced", and "" "Cluster" means that only cluster-scoped resources will match this rule. Namespace API objects are cluster-scoped. "Namespaced" means that only namespaced resources will match this rule. "" means that there are no scope restrictions. Subresources match the scope of their parent resource. Default is "*".
    api_groups Sequence[str]
    APIGroups is the API groups the resources belong to. '' is all groups. If '' is present, the length of the slice must be one. Required.
    api_versions Sequence[str]
    APIVersions is the API versions the resources belong to. '' is all versions. If '' is present, the length of the slice must be one. Required.
    operations Sequence[str]
    Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * for all of those operations and any future admission operations that are added. If '*' is present, the length of the slice must be one. Required.
    resource_names Sequence[str]
    ResourceNames is an optional white list of names that the rule applies to. An empty set means that everything is allowed.
    resources Sequence[str]

    Resources is a list of resources this rule applies to.

    For example: 'pods' means pods. 'pods/log' means the log subresource of pods. '' means all resources, but not subresources. 'pods/' means all subresources of pods. '/scale' means all scale subresources. '/*' means all resources and their subresources.

    If wildcard is present, the validation rule will ensure resources do not overlap with each other.

    Depending on the enclosing object, subresources might not be allowed. Required.

    scope str
    scope specifies the scope of this rule. Valid values are "Cluster", "Namespaced", and "" "Cluster" means that only cluster-scoped resources will match this rule. Namespace API objects are cluster-scoped. "Namespaced" means that only namespaced resources will match this rule. "" means that there are no scope restrictions. Subresources match the scope of their parent resource. Default is "*".
    apiGroups List<String>
    APIGroups is the API groups the resources belong to. '' is all groups. If '' is present, the length of the slice must be one. Required.
    apiVersions List<String>
    APIVersions is the API versions the resources belong to. '' is all versions. If '' is present, the length of the slice must be one. Required.
    operations List<String>
    Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * for all of those operations and any future admission operations that are added. If '*' is present, the length of the slice must be one. Required.
    resourceNames List<String>
    ResourceNames is an optional white list of names that the rule applies to. An empty set means that everything is allowed.
    resources List<String>

    Resources is a list of resources this rule applies to.

    For example: 'pods' means pods. 'pods/log' means the log subresource of pods. '' means all resources, but not subresources. 'pods/' means all subresources of pods. '/scale' means all scale subresources. '/*' means all resources and their subresources.

    If wildcard is present, the validation rule will ensure resources do not overlap with each other.

    Depending on the enclosing object, subresources might not be allowed. Required.

    scope String
    scope specifies the scope of this rule. Valid values are "Cluster", "Namespaced", and "" "Cluster" means that only cluster-scoped resources will match this rule. Namespace API objects are cluster-scoped. "Namespaced" means that only namespaced resources will match this rule. "" means that there are no scope restrictions. Subresources match the scope of their parent resource. Default is "*".

    ObjectMeta, ObjectMetaArgs

    Annotations Dictionary<string, string>
    Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata. They are not queryable and should be preserved when modifying objects. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
    ClusterName string
    The name of the cluster which the object belongs to. This is used to distinguish resources with same name and namespace in different clusters. This field is not set anywhere right now and apiserver is going to ignore it if set in create or update request.
    CreationTimestamp string

    CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.

    Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata

    DeletionGracePeriodSeconds int
    Number of seconds allowed for this object to gracefully terminate before it will be removed from the system. Only set when deletionTimestamp is also set. May only be shortened. Read-only.
    DeletionTimestamp string

    DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This field is set by the server when a graceful deletion is requested by the user, and is not directly settable by a client. The resource is expected to be deleted (no longer visible from resource lists, and not reachable by name) after the time in this field, once the finalizers list is empty. As long as the finalizers list contains items, deletion is blocked. Once the deletionTimestamp is set, this value may not be unset or be set further into the future, although it may be shortened or the resource may be deleted prior to this time. For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react by sending a graceful termination signal to the containers in the pod. After that 30 seconds, the Kubelet will send a hard termination signal (SIGKILL) to the container and after cleanup, remove the pod from the API. In the presence of network partitions, this object may still exist after this timestamp, until an administrator or automated process can determine the resource is fully terminated. If not set, graceful deletion of the object has not been requested.

    Populated by the system when a graceful deletion is requested. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata

    Finalizers List<string>
    Must be empty before the object is deleted from the registry. Each entry is an identifier for the responsible component that will remove the entry from the list. If the deletionTimestamp of the object is non-nil, entries in this list can only be removed. Finalizers may be processed and removed in any order. Order is NOT enforced because it introduces significant risk of stuck finalizers. finalizers is a shared field, any actor with permission can reorder it. If the finalizer list is processed in order, then this can lead to a situation in which the component responsible for the first finalizer in the list is waiting for a signal (field value, external system, or other) produced by a component responsible for a finalizer later in the list, resulting in a deadlock. Without enforced ordering finalizers are free to order amongst themselves and are not vulnerable to ordering changes in the list.
    GenerateName string

    GenerateName is an optional prefix, used by the server, to generate a unique name ONLY IF the Name field has not been provided. If this field is used, the name returned to the client will be different than the name passed. This value will also be combined with a unique suffix. The provided value has the same validation rules as the Name field, and may be truncated by the length of the suffix required to make the value unique on the server.

    If this field is specified and the generated name exists, the server will return a 409.

    Applied only if Name is not specified. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#idempotency

    Generation int
    A sequence number representing a specific generation of the desired state. Populated by the system. Read-only.
    Labels Dictionary<string, string>
    Map of string keys and values that can be used to organize and categorize (scope and select) objects. May match selectors of replication controllers and services. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
    ManagedFields List<Pulumi.Kubernetes.Meta.V1.Inputs.ManagedFieldsEntry>
    ManagedFields maps workflow-id and version to the set of fields that are managed by that workflow. This is mostly for internal housekeeping, and users typically shouldn't need to set or understand this field. A workflow can be the user's name, a controller's name, or the name of a specific apply path like "ci-cd". The set of fields is always in the version that the workflow used when modifying the object.
    Name string
    Name must be unique within a namespace. Is required when creating resources, although some resources may allow a client to request the generation of an appropriate name automatically. Name is primarily intended for creation idempotence and configuration definition. Cannot be updated. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
    Namespace string

    Namespace defines the space within which each name must be unique. An empty namespace is equivalent to the "default" namespace, but "default" is the canonical representation. Not all objects are required to be scoped to a namespace - the value of this field for those objects will be empty.

    Must be a DNS_LABEL. Cannot be updated. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces

    OwnerReferences List<Pulumi.Kubernetes.Meta.V1.Inputs.OwnerReference>
    List of objects depended by this object. If ALL objects in the list have been deleted, this object will be garbage collected. If this object is managed by a controller, then an entry in this list will point to this controller, with the controller field set to true. There cannot be more than one managing controller.
    ResourceVersion string

    An opaque value that represents the internal version of this object that can be used by clients to determine when objects have changed. May be used for optimistic concurrency, change detection, and the watch operation on a resource or set of resources. Clients must treat these values as opaque and passed unmodified back to the server. They may only be valid for a particular resource or set of resources.

    Populated by the system. Read-only. Value must be treated as opaque by clients and . More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency

    SelfLink string
    Deprecated: selfLink is a legacy read-only field that is no longer populated by the system.
    Uid string

    UID is the unique in time and space value for this object. It is typically generated by the server on successful creation of a resource and is not allowed to change on PUT operations.

    Populated by the system. Read-only. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids

    Annotations map[string]string
    Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata. They are not queryable and should be preserved when modifying objects. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
    ClusterName string
    The name of the cluster which the object belongs to. This is used to distinguish resources with same name and namespace in different clusters. This field is not set anywhere right now and apiserver is going to ignore it if set in create or update request.
    CreationTimestamp string

    CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.

    Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata

    DeletionGracePeriodSeconds int
    Number of seconds allowed for this object to gracefully terminate before it will be removed from the system. Only set when deletionTimestamp is also set. May only be shortened. Read-only.
    DeletionTimestamp string

    DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This field is set by the server when a graceful deletion is requested by the user, and is not directly settable by a client. The resource is expected to be deleted (no longer visible from resource lists, and not reachable by name) after the time in this field, once the finalizers list is empty. As long as the finalizers list contains items, deletion is blocked. Once the deletionTimestamp is set, this value may not be unset or be set further into the future, although it may be shortened or the resource may be deleted prior to this time. For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react by sending a graceful termination signal to the containers in the pod. After that 30 seconds, the Kubelet will send a hard termination signal (SIGKILL) to the container and after cleanup, remove the pod from the API. In the presence of network partitions, this object may still exist after this timestamp, until an administrator or automated process can determine the resource is fully terminated. If not set, graceful deletion of the object has not been requested.

    Populated by the system when a graceful deletion is requested. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata

    Finalizers []string
    Must be empty before the object is deleted from the registry. Each entry is an identifier for the responsible component that will remove the entry from the list. If the deletionTimestamp of the object is non-nil, entries in this list can only be removed. Finalizers may be processed and removed in any order. Order is NOT enforced because it introduces significant risk of stuck finalizers. finalizers is a shared field, any actor with permission can reorder it. If the finalizer list is processed in order, then this can lead to a situation in which the component responsible for the first finalizer in the list is waiting for a signal (field value, external system, or other) produced by a component responsible for a finalizer later in the list, resulting in a deadlock. Without enforced ordering finalizers are free to order amongst themselves and are not vulnerable to ordering changes in the list.
    GenerateName string

    GenerateName is an optional prefix, used by the server, to generate a unique name ONLY IF the Name field has not been provided. If this field is used, the name returned to the client will be different than the name passed. This value will also be combined with a unique suffix. The provided value has the same validation rules as the Name field, and may be truncated by the length of the suffix required to make the value unique on the server.

    If this field is specified and the generated name exists, the server will return a 409.

    Applied only if Name is not specified. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#idempotency

    Generation int
    A sequence number representing a specific generation of the desired state. Populated by the system. Read-only.
    Labels map[string]string
    Map of string keys and values that can be used to organize and categorize (scope and select) objects. May match selectors of replication controllers and services. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
    ManagedFields ManagedFieldsEntry
    ManagedFields maps workflow-id and version to the set of fields that are managed by that workflow. This is mostly for internal housekeeping, and users typically shouldn't need to set or understand this field. A workflow can be the user's name, a controller's name, or the name of a specific apply path like "ci-cd". The set of fields is always in the version that the workflow used when modifying the object.
    Name string
    Name must be unique within a namespace. Is required when creating resources, although some resources may allow a client to request the generation of an appropriate name automatically. Name is primarily intended for creation idempotence and configuration definition. Cannot be updated. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
    Namespace string

    Namespace defines the space within which each name must be unique. An empty namespace is equivalent to the "default" namespace, but "default" is the canonical representation. Not all objects are required to be scoped to a namespace - the value of this field for those objects will be empty.

    Must be a DNS_LABEL. Cannot be updated. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces

    OwnerReferences OwnerReference
    List of objects depended by this object. If ALL objects in the list have been deleted, this object will be garbage collected. If this object is managed by a controller, then an entry in this list will point to this controller, with the controller field set to true. There cannot be more than one managing controller.
    ResourceVersion string

    An opaque value that represents the internal version of this object that can be used by clients to determine when objects have changed. May be used for optimistic concurrency, change detection, and the watch operation on a resource or set of resources. Clients must treat these values as opaque and passed unmodified back to the server. They may only be valid for a particular resource or set of resources.

    Populated by the system. Read-only. Value must be treated as opaque by clients and . More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency

    SelfLink string
    Deprecated: selfLink is a legacy read-only field that is no longer populated by the system.
    Uid string

    UID is the unique in time and space value for this object. It is typically generated by the server on successful creation of a resource and is not allowed to change on PUT operations.

    Populated by the system. Read-only. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids

    annotations Map<String,String>
    Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata. They are not queryable and should be preserved when modifying objects. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
    clusterName String
    The name of the cluster which the object belongs to. This is used to distinguish resources with same name and namespace in different clusters. This field is not set anywhere right now and apiserver is going to ignore it if set in create or update request.
    creationTimestamp String

    CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.

    Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata

    deletionGracePeriodSeconds Integer
    Number of seconds allowed for this object to gracefully terminate before it will be removed from the system. Only set when deletionTimestamp is also set. May only be shortened. Read-only.
    deletionTimestamp String

    DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This field is set by the server when a graceful deletion is requested by the user, and is not directly settable by a client. The resource is expected to be deleted (no longer visible from resource lists, and not reachable by name) after the time in this field, once the finalizers list is empty. As long as the finalizers list contains items, deletion is blocked. Once the deletionTimestamp is set, this value may not be unset or be set further into the future, although it may be shortened or the resource may be deleted prior to this time. For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react by sending a graceful termination signal to the containers in the pod. After that 30 seconds, the Kubelet will send a hard termination signal (SIGKILL) to the container and after cleanup, remove the pod from the API. In the presence of network partitions, this object may still exist after this timestamp, until an administrator or automated process can determine the resource is fully terminated. If not set, graceful deletion of the object has not been requested.

    Populated by the system when a graceful deletion is requested. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata

    finalizers List<String>
    Must be empty before the object is deleted from the registry. Each entry is an identifier for the responsible component that will remove the entry from the list. If the deletionTimestamp of the object is non-nil, entries in this list can only be removed. Finalizers may be processed and removed in any order. Order is NOT enforced because it introduces significant risk of stuck finalizers. finalizers is a shared field, any actor with permission can reorder it. If the finalizer list is processed in order, then this can lead to a situation in which the component responsible for the first finalizer in the list is waiting for a signal (field value, external system, or other) produced by a component responsible for a finalizer later in the list, resulting in a deadlock. Without enforced ordering finalizers are free to order amongst themselves and are not vulnerable to ordering changes in the list.
    generateName String

    GenerateName is an optional prefix, used by the server, to generate a unique name ONLY IF the Name field has not been provided. If this field is used, the name returned to the client will be different than the name passed. This value will also be combined with a unique suffix. The provided value has the same validation rules as the Name field, and may be truncated by the length of the suffix required to make the value unique on the server.

    If this field is specified and the generated name exists, the server will return a 409.

    Applied only if Name is not specified. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#idempotency

    generation Integer
    A sequence number representing a specific generation of the desired state. Populated by the system. Read-only.
    labels Map<String,String>
    Map of string keys and values that can be used to organize and categorize (scope and select) objects. May match selectors of replication controllers and services. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
    managedFields List<ManagedFieldsEntry>
    ManagedFields maps workflow-id and version to the set of fields that are managed by that workflow. This is mostly for internal housekeeping, and users typically shouldn't need to set or understand this field. A workflow can be the user's name, a controller's name, or the name of a specific apply path like "ci-cd". The set of fields is always in the version that the workflow used when modifying the object.
    name String
    Name must be unique within a namespace. Is required when creating resources, although some resources may allow a client to request the generation of an appropriate name automatically. Name is primarily intended for creation idempotence and configuration definition. Cannot be updated. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
    namespace String

    Namespace defines the space within which each name must be unique. An empty namespace is equivalent to the "default" namespace, but "default" is the canonical representation. Not all objects are required to be scoped to a namespace - the value of this field for those objects will be empty.

    Must be a DNS_LABEL. Cannot be updated. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces

    ownerReferences List<OwnerReference>
    List of objects depended by this object. If ALL objects in the list have been deleted, this object will be garbage collected. If this object is managed by a controller, then an entry in this list will point to this controller, with the controller field set to true. There cannot be more than one managing controller.
    resourceVersion String

    An opaque value that represents the internal version of this object that can be used by clients to determine when objects have changed. May be used for optimistic concurrency, change detection, and the watch operation on a resource or set of resources. Clients must treat these values as opaque and passed unmodified back to the server. They may only be valid for a particular resource or set of resources.

    Populated by the system. Read-only. Value must be treated as opaque by clients and . More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency

    selfLink String
    Deprecated: selfLink is a legacy read-only field that is no longer populated by the system.
    uid String

    UID is the unique in time and space value for this object. It is typically generated by the server on successful creation of a resource and is not allowed to change on PUT operations.

    Populated by the system. Read-only. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids

    annotations {[key: string]: string}
    Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata. They are not queryable and should be preserved when modifying objects. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
    clusterName string
    The name of the cluster which the object belongs to. This is used to distinguish resources with same name and namespace in different clusters. This field is not set anywhere right now and apiserver is going to ignore it if set in create or update request.
    creationTimestamp string

    CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.

    Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata

    deletionGracePeriodSeconds number
    Number of seconds allowed for this object to gracefully terminate before it will be removed from the system. Only set when deletionTimestamp is also set. May only be shortened. Read-only.
    deletionTimestamp string

    DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This field is set by the server when a graceful deletion is requested by the user, and is not directly settable by a client. The resource is expected to be deleted (no longer visible from resource lists, and not reachable by name) after the time in this field, once the finalizers list is empty. As long as the finalizers list contains items, deletion is blocked. Once the deletionTimestamp is set, this value may not be unset or be set further into the future, although it may be shortened or the resource may be deleted prior to this time. For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react by sending a graceful termination signal to the containers in the pod. After that 30 seconds, the Kubelet will send a hard termination signal (SIGKILL) to the container and after cleanup, remove the pod from the API. In the presence of network partitions, this object may still exist after this timestamp, until an administrator or automated process can determine the resource is fully terminated. If not set, graceful deletion of the object has not been requested.

    Populated by the system when a graceful deletion is requested. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata

    finalizers string[]
    Must be empty before the object is deleted from the registry. Each entry is an identifier for the responsible component that will remove the entry from the list. If the deletionTimestamp of the object is non-nil, entries in this list can only be removed. Finalizers may be processed and removed in any order. Order is NOT enforced because it introduces significant risk of stuck finalizers. finalizers is a shared field, any actor with permission can reorder it. If the finalizer list is processed in order, then this can lead to a situation in which the component responsible for the first finalizer in the list is waiting for a signal (field value, external system, or other) produced by a component responsible for a finalizer later in the list, resulting in a deadlock. Without enforced ordering finalizers are free to order amongst themselves and are not vulnerable to ordering changes in the list.
    generateName string

    GenerateName is an optional prefix, used by the server, to generate a unique name ONLY IF the Name field has not been provided. If this field is used, the name returned to the client will be different than the name passed. This value will also be combined with a unique suffix. The provided value has the same validation rules as the Name field, and may be truncated by the length of the suffix required to make the value unique on the server.

    If this field is specified and the generated name exists, the server will return a 409.

    Applied only if Name is not specified. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#idempotency

    generation number
    A sequence number representing a specific generation of the desired state. Populated by the system. Read-only.
    labels {[key: string]: string}
    Map of string keys and values that can be used to organize and categorize (scope and select) objects. May match selectors of replication controllers and services. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
    managedFields meta.v1.ManagedFieldsEntry[]
    ManagedFields maps workflow-id and version to the set of fields that are managed by that workflow. This is mostly for internal housekeeping, and users typically shouldn't need to set or understand this field. A workflow can be the user's name, a controller's name, or the name of a specific apply path like "ci-cd". The set of fields is always in the version that the workflow used when modifying the object.
    name string
    Name must be unique within a namespace. Is required when creating resources, although some resources may allow a client to request the generation of an appropriate name automatically. Name is primarily intended for creation idempotence and configuration definition. Cannot be updated. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
    namespace string

    Namespace defines the space within which each name must be unique. An empty namespace is equivalent to the "default" namespace, but "default" is the canonical representation. Not all objects are required to be scoped to a namespace - the value of this field for those objects will be empty.

    Must be a DNS_LABEL. Cannot be updated. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces

    ownerReferences meta.v1.OwnerReference[]
    List of objects depended by this object. If ALL objects in the list have been deleted, this object will be garbage collected. If this object is managed by a controller, then an entry in this list will point to this controller, with the controller field set to true. There cannot be more than one managing controller.
    resourceVersion string

    An opaque value that represents the internal version of this object that can be used by clients to determine when objects have changed. May be used for optimistic concurrency, change detection, and the watch operation on a resource or set of resources. Clients must treat these values as opaque and passed unmodified back to the server. They may only be valid for a particular resource or set of resources.

    Populated by the system. Read-only. Value must be treated as opaque by clients and . More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency

    selfLink string
    Deprecated: selfLink is a legacy read-only field that is no longer populated by the system.
    uid string

    UID is the unique in time and space value for this object. It is typically generated by the server on successful creation of a resource and is not allowed to change on PUT operations.

    Populated by the system. Read-only. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids

    annotations Mapping[str, str]
    Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata. They are not queryable and should be preserved when modifying objects. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
    cluster_name str
    The name of the cluster which the object belongs to. This is used to distinguish resources with same name and namespace in different clusters. This field is not set anywhere right now and apiserver is going to ignore it if set in create or update request.
    creation_timestamp str

    CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.

    Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata

    deletion_grace_period_seconds int
    Number of seconds allowed for this object to gracefully terminate before it will be removed from the system. Only set when deletionTimestamp is also set. May only be shortened. Read-only.
    deletion_timestamp str

    DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This field is set by the server when a graceful deletion is requested by the user, and is not directly settable by a client. The resource is expected to be deleted (no longer visible from resource lists, and not reachable by name) after the time in this field, once the finalizers list is empty. As long as the finalizers list contains items, deletion is blocked. Once the deletionTimestamp is set, this value may not be unset or be set further into the future, although it may be shortened or the resource may be deleted prior to this time. For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react by sending a graceful termination signal to the containers in the pod. After that 30 seconds, the Kubelet will send a hard termination signal (SIGKILL) to the container and after cleanup, remove the pod from the API. In the presence of network partitions, this object may still exist after this timestamp, until an administrator or automated process can determine the resource is fully terminated. If not set, graceful deletion of the object has not been requested.

    Populated by the system when a graceful deletion is requested. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata

    finalizers Sequence[str]
    Must be empty before the object is deleted from the registry. Each entry is an identifier for the responsible component that will remove the entry from the list. If the deletionTimestamp of the object is non-nil, entries in this list can only be removed. Finalizers may be processed and removed in any order. Order is NOT enforced because it introduces significant risk of stuck finalizers. finalizers is a shared field, any actor with permission can reorder it. If the finalizer list is processed in order, then this can lead to a situation in which the component responsible for the first finalizer in the list is waiting for a signal (field value, external system, or other) produced by a component responsible for a finalizer later in the list, resulting in a deadlock. Without enforced ordering finalizers are free to order amongst themselves and are not vulnerable to ordering changes in the list.
    generate_name str

    GenerateName is an optional prefix, used by the server, to generate a unique name ONLY IF the Name field has not been provided. If this field is used, the name returned to the client will be different than the name passed. This value will also be combined with a unique suffix. The provided value has the same validation rules as the Name field, and may be truncated by the length of the suffix required to make the value unique on the server.

    If this field is specified and the generated name exists, the server will return a 409.

    Applied only if Name is not specified. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#idempotency

    generation int
    A sequence number representing a specific generation of the desired state. Populated by the system. Read-only.
    labels Mapping[str, str]
    Map of string keys and values that can be used to organize and categorize (scope and select) objects. May match selectors of replication controllers and services. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
    managed_fields Sequence[meta.v1.ManagedFieldsEntry]
    ManagedFields maps workflow-id and version to the set of fields that are managed by that workflow. This is mostly for internal housekeeping, and users typically shouldn't need to set or understand this field. A workflow can be the user's name, a controller's name, or the name of a specific apply path like "ci-cd". The set of fields is always in the version that the workflow used when modifying the object.
    name str
    Name must be unique within a namespace. Is required when creating resources, although some resources may allow a client to request the generation of an appropriate name automatically. Name is primarily intended for creation idempotence and configuration definition. Cannot be updated. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
    namespace str

    Namespace defines the space within which each name must be unique. An empty namespace is equivalent to the "default" namespace, but "default" is the canonical representation. Not all objects are required to be scoped to a namespace - the value of this field for those objects will be empty.

    Must be a DNS_LABEL. Cannot be updated. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces

    owner_references Sequence[meta.v1.OwnerReference]
    List of objects depended by this object. If ALL objects in the list have been deleted, this object will be garbage collected. If this object is managed by a controller, then an entry in this list will point to this controller, with the controller field set to true. There cannot be more than one managing controller.
    resource_version str

    An opaque value that represents the internal version of this object that can be used by clients to determine when objects have changed. May be used for optimistic concurrency, change detection, and the watch operation on a resource or set of resources. Clients must treat these values as opaque and passed unmodified back to the server. They may only be valid for a particular resource or set of resources.

    Populated by the system. Read-only. Value must be treated as opaque by clients and . More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency

    self_link str
    Deprecated: selfLink is a legacy read-only field that is no longer populated by the system.
    uid str

    UID is the unique in time and space value for this object. It is typically generated by the server on successful creation of a resource and is not allowed to change on PUT operations.

    Populated by the system. Read-only. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids

    annotations Map<String>
    Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata. They are not queryable and should be preserved when modifying objects. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations
    clusterName String
    The name of the cluster which the object belongs to. This is used to distinguish resources with same name and namespace in different clusters. This field is not set anywhere right now and apiserver is going to ignore it if set in create or update request.
    creationTimestamp String

    CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.

    Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata

    deletionGracePeriodSeconds Number
    Number of seconds allowed for this object to gracefully terminate before it will be removed from the system. Only set when deletionTimestamp is also set. May only be shortened. Read-only.
    deletionTimestamp String

    DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This field is set by the server when a graceful deletion is requested by the user, and is not directly settable by a client. The resource is expected to be deleted (no longer visible from resource lists, and not reachable by name) after the time in this field, once the finalizers list is empty. As long as the finalizers list contains items, deletion is blocked. Once the deletionTimestamp is set, this value may not be unset or be set further into the future, although it may be shortened or the resource may be deleted prior to this time. For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react by sending a graceful termination signal to the containers in the pod. After that 30 seconds, the Kubelet will send a hard termination signal (SIGKILL) to the container and after cleanup, remove the pod from the API. In the presence of network partitions, this object may still exist after this timestamp, until an administrator or automated process can determine the resource is fully terminated. If not set, graceful deletion of the object has not been requested.

    Populated by the system when a graceful deletion is requested. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata

    finalizers List<String>
    Must be empty before the object is deleted from the registry. Each entry is an identifier for the responsible component that will remove the entry from the list. If the deletionTimestamp of the object is non-nil, entries in this list can only be removed. Finalizers may be processed and removed in any order. Order is NOT enforced because it introduces significant risk of stuck finalizers. finalizers is a shared field, any actor with permission can reorder it. If the finalizer list is processed in order, then this can lead to a situation in which the component responsible for the first finalizer in the list is waiting for a signal (field value, external system, or other) produced by a component responsible for a finalizer later in the list, resulting in a deadlock. Without enforced ordering finalizers are free to order amongst themselves and are not vulnerable to ordering changes in the list.
    generateName String

    GenerateName is an optional prefix, used by the server, to generate a unique name ONLY IF the Name field has not been provided. If this field is used, the name returned to the client will be different than the name passed. This value will also be combined with a unique suffix. The provided value has the same validation rules as the Name field, and may be truncated by the length of the suffix required to make the value unique on the server.

    If this field is specified and the generated name exists, the server will return a 409.

    Applied only if Name is not specified. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#idempotency

    generation Number
    A sequence number representing a specific generation of the desired state. Populated by the system. Read-only.
    labels Map<String>
    Map of string keys and values that can be used to organize and categorize (scope and select) objects. May match selectors of replication controllers and services. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
    managedFields List<Property Map>
    ManagedFields maps workflow-id and version to the set of fields that are managed by that workflow. This is mostly for internal housekeeping, and users typically shouldn't need to set or understand this field. A workflow can be the user's name, a controller's name, or the name of a specific apply path like "ci-cd". The set of fields is always in the version that the workflow used when modifying the object.
    name String
    Name must be unique within a namespace. Is required when creating resources, although some resources may allow a client to request the generation of an appropriate name automatically. Name is primarily intended for creation idempotence and configuration definition. Cannot be updated. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
    namespace String

    Namespace defines the space within which each name must be unique. An empty namespace is equivalent to the "default" namespace, but "default" is the canonical representation. Not all objects are required to be scoped to a namespace - the value of this field for those objects will be empty.

    Must be a DNS_LABEL. Cannot be updated. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces

    ownerReferences List<Property Map>
    List of objects depended by this object. If ALL objects in the list have been deleted, this object will be garbage collected. If this object is managed by a controller, then an entry in this list will point to this controller, with the controller field set to true. There cannot be more than one managing controller.
    resourceVersion String

    An opaque value that represents the internal version of this object that can be used by clients to determine when objects have changed. May be used for optimistic concurrency, change detection, and the watch operation on a resource or set of resources. Clients must treat these values as opaque and passed unmodified back to the server. They may only be valid for a particular resource or set of resources.

    Populated by the system. Read-only. Value must be treated as opaque by clients and . More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency

    selfLink String
    Deprecated: selfLink is a legacy read-only field that is no longer populated by the system.
    uid String

    UID is the unique in time and space value for this object. It is typically generated by the server on successful creation of a resource and is not allowed to change on PUT operations.

    Populated by the system. Read-only. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids

    OwnerReference, OwnerReferenceArgs

    ApiVersion string
    API version of the referent.
    Kind string
    Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    Name string
    Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
    Uid string
    UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids
    BlockOwnerDeletion bool
    If true, AND if the owner has the "foregroundDeletion" finalizer, then the owner cannot be deleted from the key-value store until this reference is removed. See https://kubernetes.io/docs/concepts/architecture/garbage-collection/#foreground-deletion for how the garbage collector interacts with this field and enforces the foreground deletion. Defaults to false. To set this field, a user needs "delete" permission of the owner, otherwise 422 (Unprocessable Entity) will be returned.
    Controller bool
    If true, this reference points to the managing controller.
    ApiVersion string
    API version of the referent.
    Kind string
    Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    Name string
    Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
    Uid string
    UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids
    BlockOwnerDeletion bool
    If true, AND if the owner has the "foregroundDeletion" finalizer, then the owner cannot be deleted from the key-value store until this reference is removed. See https://kubernetes.io/docs/concepts/architecture/garbage-collection/#foreground-deletion for how the garbage collector interacts with this field and enforces the foreground deletion. Defaults to false. To set this field, a user needs "delete" permission of the owner, otherwise 422 (Unprocessable Entity) will be returned.
    Controller bool
    If true, this reference points to the managing controller.
    apiVersion String
    API version of the referent.
    kind String
    Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    name String
    Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
    uid String
    UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids
    blockOwnerDeletion Boolean
    If true, AND if the owner has the "foregroundDeletion" finalizer, then the owner cannot be deleted from the key-value store until this reference is removed. See https://kubernetes.io/docs/concepts/architecture/garbage-collection/#foreground-deletion for how the garbage collector interacts with this field and enforces the foreground deletion. Defaults to false. To set this field, a user needs "delete" permission of the owner, otherwise 422 (Unprocessable Entity) will be returned.
    controller Boolean
    If true, this reference points to the managing controller.
    apiVersion string
    API version of the referent.
    kind string
    Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    name string
    Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
    uid string
    UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids
    blockOwnerDeletion boolean
    If true, AND if the owner has the "foregroundDeletion" finalizer, then the owner cannot be deleted from the key-value store until this reference is removed. See https://kubernetes.io/docs/concepts/architecture/garbage-collection/#foreground-deletion for how the garbage collector interacts with this field and enforces the foreground deletion. Defaults to false. To set this field, a user needs "delete" permission of the owner, otherwise 422 (Unprocessable Entity) will be returned.
    controller boolean
    If true, this reference points to the managing controller.
    api_version str
    API version of the referent.
    kind str
    Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    name str
    Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
    uid str
    UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids
    block_owner_deletion bool
    If true, AND if the owner has the "foregroundDeletion" finalizer, then the owner cannot be deleted from the key-value store until this reference is removed. See https://kubernetes.io/docs/concepts/architecture/garbage-collection/#foreground-deletion for how the garbage collector interacts with this field and enforces the foreground deletion. Defaults to false. To set this field, a user needs "delete" permission of the owner, otherwise 422 (Unprocessable Entity) will be returned.
    controller bool
    If true, this reference points to the managing controller.
    apiVersion String
    API version of the referent.
    kind String
    Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    name String
    Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
    uid String
    UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids
    blockOwnerDeletion Boolean
    If true, AND if the owner has the "foregroundDeletion" finalizer, then the owner cannot be deleted from the key-value store until this reference is removed. See https://kubernetes.io/docs/concepts/architecture/garbage-collection/#foreground-deletion for how the garbage collector interacts with this field and enforces the foreground deletion. Defaults to false. To set this field, a user needs "delete" permission of the owner, otherwise 422 (Unprocessable Entity) will be returned.
    controller Boolean
    If true, this reference points to the managing controller.

    ParamKind, ParamKindArgs

    ApiVersion string
    APIVersion is the API group version the resources belong to. In format of "group/version". Required.
    Kind string
    Kind is the API kind the resources belong to. Required.
    ApiVersion string
    APIVersion is the API group version the resources belong to. In format of "group/version". Required.
    Kind string
    Kind is the API kind the resources belong to. Required.
    apiVersion String
    APIVersion is the API group version the resources belong to. In format of "group/version". Required.
    kind String
    Kind is the API kind the resources belong to. Required.
    apiVersion string
    APIVersion is the API group version the resources belong to. In format of "group/version". Required.
    kind string
    Kind is the API kind the resources belong to. Required.
    api_version str
    APIVersion is the API group version the resources belong to. In format of "group/version". Required.
    kind str
    Kind is the API kind the resources belong to. Required.
    apiVersion String
    APIVersion is the API group version the resources belong to. In format of "group/version". Required.
    kind String
    Kind is the API kind the resources belong to. Required.

    TypeChecking, TypeCheckingArgs

    ExpressionWarnings List<ExpressionWarning>
    The type checking warnings for each expression.
    ExpressionWarnings []ExpressionWarning
    The type checking warnings for each expression.
    expressionWarnings List<ExpressionWarning>
    The type checking warnings for each expression.
    expressionWarnings ExpressionWarning[]
    The type checking warnings for each expression.
    expressionWarnings List<Property Map>
    The type checking warnings for each expression.

    ValidatingAdmissionPolicy, ValidatingAdmissionPolicyArgs

    Metadata Pulumi.Kubernetes.Meta.V1.Inputs.ObjectMeta
    Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
    Spec ValidatingAdmissionPolicySpec
    Specification of the desired behavior of the ValidatingAdmissionPolicy.
    Status ValidatingAdmissionPolicyStatus
    The status of the ValidatingAdmissionPolicy, including warnings that are useful to determine if the policy behaves in the expected way. Populated by the system. Read-only.
    Metadata ObjectMeta
    Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
    Spec ValidatingAdmissionPolicySpec
    Specification of the desired behavior of the ValidatingAdmissionPolicy.
    Status ValidatingAdmissionPolicyStatus
    The status of the ValidatingAdmissionPolicy, including warnings that are useful to determine if the policy behaves in the expected way. Populated by the system. Read-only.
    metadata ObjectMeta
    Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
    spec ValidatingAdmissionPolicySpec
    Specification of the desired behavior of the ValidatingAdmissionPolicy.
    status ValidatingAdmissionPolicyStatus
    The status of the ValidatingAdmissionPolicy, including warnings that are useful to determine if the policy behaves in the expected way. Populated by the system. Read-only.
    metadata meta.v1.ObjectMeta
    Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
    spec ValidatingAdmissionPolicySpec
    Specification of the desired behavior of the ValidatingAdmissionPolicy.
    status ValidatingAdmissionPolicyStatus
    The status of the ValidatingAdmissionPolicy, including warnings that are useful to determine if the policy behaves in the expected way. Populated by the system. Read-only.
    metadata meta.v1.ObjectMeta
    Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
    spec admissionregistration_k8s_io.v1beta1.ValidatingAdmissionPolicySpec
    Specification of the desired behavior of the ValidatingAdmissionPolicy.
    status admissionregistration_k8s_io.v1beta1.ValidatingAdmissionPolicyStatus
    The status of the ValidatingAdmissionPolicy, including warnings that are useful to determine if the policy behaves in the expected way. Populated by the system. Read-only.
    metadata Property Map
    Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
    spec Property Map
    Specification of the desired behavior of the ValidatingAdmissionPolicy.
    status Property Map
    The status of the ValidatingAdmissionPolicy, including warnings that are useful to determine if the policy behaves in the expected way. Populated by the system. Read-only.

    ValidatingAdmissionPolicySpec, ValidatingAdmissionPolicySpecArgs

    AuditAnnotations List<AuditAnnotation>
    auditAnnotations contains CEL expressions which are used to produce audit annotations for the audit event of the API request. validations and auditAnnotations may not both be empty; a least one of validations or auditAnnotations is required.
    FailurePolicy string

    failurePolicy defines how to handle failures for the admission policy. Failures can occur from CEL expression parse errors, type check errors, runtime errors and invalid or mis-configured policy definitions or bindings.

    A policy is invalid if spec.paramKind refers to a non-existent Kind. A binding is invalid if spec.paramRef.name refers to a non-existent resource.

    failurePolicy does not define how validations that evaluate to false are handled.

    When failurePolicy is set to Fail, ValidatingAdmissionPolicyBinding validationActions define how failures are enforced.

    Allowed values are Ignore or Fail. Defaults to Fail.

    MatchConditions List<MatchCondition>

    MatchConditions is a list of conditions that must be met for a request to be validated. Match conditions filter requests that have already been matched by the rules, namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests. There are a maximum of 64 match conditions allowed.

    If a parameter object is provided, it can be accessed via the params handle in the same manner as validation expressions.

    The exact matching logic is (in order):

    1. If ANY matchCondition evaluates to FALSE, the policy is skipped.
    2. If ALL matchConditions evaluate to TRUE, the policy is evaluated.
    3. If any matchCondition evaluates to an error (but none are FALSE):
      • If failurePolicy=Fail, reject the request
      • If failurePolicy=Ignore, the policy is skipped
    MatchConstraints MatchResources
    MatchConstraints specifies what resources this policy is designed to validate. The AdmissionPolicy cares about a request if it matches all Constraints. However, in order to prevent clusters from being put into an unstable state that cannot be recovered from via the API ValidatingAdmissionPolicy cannot match ValidatingAdmissionPolicy and ValidatingAdmissionPolicyBinding. Required.
    ParamKind ParamKind
    ParamKind specifies the kind of resources used to parameterize this policy. If absent, there are no parameters for this policy and the param CEL variable will not be provided to validation expressions. If ParamKind refers to a non-existent kind, this policy definition is mis-configured and the FailurePolicy is applied. If paramKind is specified but paramRef is unset in ValidatingAdmissionPolicyBinding, the params variable will be null.
    Validations List<Validation>
    Validations contain CEL expressions which is used to apply the validation. Validations and AuditAnnotations may not both be empty; a minimum of one Validations or AuditAnnotations is required.
    Variables List<Variable>

    Variables contain definitions of variables that can be used in composition of other expressions. Each variable is defined as a named CEL expression. The variables defined here will be available under variables in other expressions of the policy except MatchConditions because MatchConditions are evaluated before the rest of the policy.

    The expression of a variable can refer to other variables defined earlier in the list but not those after. Thus, Variables must be sorted by the order of first appearance and acyclic.

    AuditAnnotations []AuditAnnotation
    auditAnnotations contains CEL expressions which are used to produce audit annotations for the audit event of the API request. validations and auditAnnotations may not both be empty; a least one of validations or auditAnnotations is required.
    FailurePolicy string

    failurePolicy defines how to handle failures for the admission policy. Failures can occur from CEL expression parse errors, type check errors, runtime errors and invalid or mis-configured policy definitions or bindings.

    A policy is invalid if spec.paramKind refers to a non-existent Kind. A binding is invalid if spec.paramRef.name refers to a non-existent resource.

    failurePolicy does not define how validations that evaluate to false are handled.

    When failurePolicy is set to Fail, ValidatingAdmissionPolicyBinding validationActions define how failures are enforced.

    Allowed values are Ignore or Fail. Defaults to Fail.

    MatchConditions []MatchCondition

    MatchConditions is a list of conditions that must be met for a request to be validated. Match conditions filter requests that have already been matched by the rules, namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests. There are a maximum of 64 match conditions allowed.

    If a parameter object is provided, it can be accessed via the params handle in the same manner as validation expressions.

    The exact matching logic is (in order):

    1. If ANY matchCondition evaluates to FALSE, the policy is skipped.
    2. If ALL matchConditions evaluate to TRUE, the policy is evaluated.
    3. If any matchCondition evaluates to an error (but none are FALSE):
      • If failurePolicy=Fail, reject the request
      • If failurePolicy=Ignore, the policy is skipped
    MatchConstraints MatchResources
    MatchConstraints specifies what resources this policy is designed to validate. The AdmissionPolicy cares about a request if it matches all Constraints. However, in order to prevent clusters from being put into an unstable state that cannot be recovered from via the API ValidatingAdmissionPolicy cannot match ValidatingAdmissionPolicy and ValidatingAdmissionPolicyBinding. Required.
    ParamKind ParamKind
    ParamKind specifies the kind of resources used to parameterize this policy. If absent, there are no parameters for this policy and the param CEL variable will not be provided to validation expressions. If ParamKind refers to a non-existent kind, this policy definition is mis-configured and the FailurePolicy is applied. If paramKind is specified but paramRef is unset in ValidatingAdmissionPolicyBinding, the params variable will be null.
    Validations []Validation
    Validations contain CEL expressions which is used to apply the validation. Validations and AuditAnnotations may not both be empty; a minimum of one Validations or AuditAnnotations is required.
    Variables []Variable

    Variables contain definitions of variables that can be used in composition of other expressions. Each variable is defined as a named CEL expression. The variables defined here will be available under variables in other expressions of the policy except MatchConditions because MatchConditions are evaluated before the rest of the policy.

    The expression of a variable can refer to other variables defined earlier in the list but not those after. Thus, Variables must be sorted by the order of first appearance and acyclic.

    auditAnnotations List<AuditAnnotation>
    auditAnnotations contains CEL expressions which are used to produce audit annotations for the audit event of the API request. validations and auditAnnotations may not both be empty; a least one of validations or auditAnnotations is required.
    failurePolicy String

    failurePolicy defines how to handle failures for the admission policy. Failures can occur from CEL expression parse errors, type check errors, runtime errors and invalid or mis-configured policy definitions or bindings.

    A policy is invalid if spec.paramKind refers to a non-existent Kind. A binding is invalid if spec.paramRef.name refers to a non-existent resource.

    failurePolicy does not define how validations that evaluate to false are handled.

    When failurePolicy is set to Fail, ValidatingAdmissionPolicyBinding validationActions define how failures are enforced.

    Allowed values are Ignore or Fail. Defaults to Fail.

    matchConditions List<MatchCondition>

    MatchConditions is a list of conditions that must be met for a request to be validated. Match conditions filter requests that have already been matched by the rules, namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests. There are a maximum of 64 match conditions allowed.

    If a parameter object is provided, it can be accessed via the params handle in the same manner as validation expressions.

    The exact matching logic is (in order):

    1. If ANY matchCondition evaluates to FALSE, the policy is skipped.
    2. If ALL matchConditions evaluate to TRUE, the policy is evaluated.
    3. If any matchCondition evaluates to an error (but none are FALSE):
      • If failurePolicy=Fail, reject the request
      • If failurePolicy=Ignore, the policy is skipped
    matchConstraints MatchResources
    MatchConstraints specifies what resources this policy is designed to validate. The AdmissionPolicy cares about a request if it matches all Constraints. However, in order to prevent clusters from being put into an unstable state that cannot be recovered from via the API ValidatingAdmissionPolicy cannot match ValidatingAdmissionPolicy and ValidatingAdmissionPolicyBinding. Required.
    paramKind ParamKind
    ParamKind specifies the kind of resources used to parameterize this policy. If absent, there are no parameters for this policy and the param CEL variable will not be provided to validation expressions. If ParamKind refers to a non-existent kind, this policy definition is mis-configured and the FailurePolicy is applied. If paramKind is specified but paramRef is unset in ValidatingAdmissionPolicyBinding, the params variable will be null.
    validations List<Validation>
    Validations contain CEL expressions which is used to apply the validation. Validations and AuditAnnotations may not both be empty; a minimum of one Validations or AuditAnnotations is required.
    variables List<Variable>

    Variables contain definitions of variables that can be used in composition of other expressions. Each variable is defined as a named CEL expression. The variables defined here will be available under variables in other expressions of the policy except MatchConditions because MatchConditions are evaluated before the rest of the policy.

    The expression of a variable can refer to other variables defined earlier in the list but not those after. Thus, Variables must be sorted by the order of first appearance and acyclic.

    auditAnnotations AuditAnnotation[]
    auditAnnotations contains CEL expressions which are used to produce audit annotations for the audit event of the API request. validations and auditAnnotations may not both be empty; a least one of validations or auditAnnotations is required.
    failurePolicy string

    failurePolicy defines how to handle failures for the admission policy. Failures can occur from CEL expression parse errors, type check errors, runtime errors and invalid or mis-configured policy definitions or bindings.

    A policy is invalid if spec.paramKind refers to a non-existent Kind. A binding is invalid if spec.paramRef.name refers to a non-existent resource.

    failurePolicy does not define how validations that evaluate to false are handled.

    When failurePolicy is set to Fail, ValidatingAdmissionPolicyBinding validationActions define how failures are enforced.

    Allowed values are Ignore or Fail. Defaults to Fail.

    matchConditions MatchCondition[]

    MatchConditions is a list of conditions that must be met for a request to be validated. Match conditions filter requests that have already been matched by the rules, namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests. There are a maximum of 64 match conditions allowed.

    If a parameter object is provided, it can be accessed via the params handle in the same manner as validation expressions.

    The exact matching logic is (in order):

    1. If ANY matchCondition evaluates to FALSE, the policy is skipped.
    2. If ALL matchConditions evaluate to TRUE, the policy is evaluated.
    3. If any matchCondition evaluates to an error (but none are FALSE):
      • If failurePolicy=Fail, reject the request
      • If failurePolicy=Ignore, the policy is skipped
    matchConstraints MatchResources
    MatchConstraints specifies what resources this policy is designed to validate. The AdmissionPolicy cares about a request if it matches all Constraints. However, in order to prevent clusters from being put into an unstable state that cannot be recovered from via the API ValidatingAdmissionPolicy cannot match ValidatingAdmissionPolicy and ValidatingAdmissionPolicyBinding. Required.
    paramKind ParamKind
    ParamKind specifies the kind of resources used to parameterize this policy. If absent, there are no parameters for this policy and the param CEL variable will not be provided to validation expressions. If ParamKind refers to a non-existent kind, this policy definition is mis-configured and the FailurePolicy is applied. If paramKind is specified but paramRef is unset in ValidatingAdmissionPolicyBinding, the params variable will be null.
    validations Validation[]
    Validations contain CEL expressions which is used to apply the validation. Validations and AuditAnnotations may not both be empty; a minimum of one Validations or AuditAnnotations is required.
    variables Variable[]

    Variables contain definitions of variables that can be used in composition of other expressions. Each variable is defined as a named CEL expression. The variables defined here will be available under variables in other expressions of the policy except MatchConditions because MatchConditions are evaluated before the rest of the policy.

    The expression of a variable can refer to other variables defined earlier in the list but not those after. Thus, Variables must be sorted by the order of first appearance and acyclic.

    audit_annotations Sequence[admissionregistration_k8s_io.v1beta1.AuditAnnotation]
    auditAnnotations contains CEL expressions which are used to produce audit annotations for the audit event of the API request. validations and auditAnnotations may not both be empty; a least one of validations or auditAnnotations is required.
    failure_policy str

    failurePolicy defines how to handle failures for the admission policy. Failures can occur from CEL expression parse errors, type check errors, runtime errors and invalid or mis-configured policy definitions or bindings.

    A policy is invalid if spec.paramKind refers to a non-existent Kind. A binding is invalid if spec.paramRef.name refers to a non-existent resource.

    failurePolicy does not define how validations that evaluate to false are handled.

    When failurePolicy is set to Fail, ValidatingAdmissionPolicyBinding validationActions define how failures are enforced.

    Allowed values are Ignore or Fail. Defaults to Fail.

    match_conditions Sequence[admissionregistration_k8s_io.v1beta1.MatchCondition]

    MatchConditions is a list of conditions that must be met for a request to be validated. Match conditions filter requests that have already been matched by the rules, namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests. There are a maximum of 64 match conditions allowed.

    If a parameter object is provided, it can be accessed via the params handle in the same manner as validation expressions.

    The exact matching logic is (in order):

    1. If ANY matchCondition evaluates to FALSE, the policy is skipped.
    2. If ALL matchConditions evaluate to TRUE, the policy is evaluated.
    3. If any matchCondition evaluates to an error (but none are FALSE):
      • If failurePolicy=Fail, reject the request
      • If failurePolicy=Ignore, the policy is skipped
    match_constraints admissionregistration_k8s_io.v1beta1.MatchResources
    MatchConstraints specifies what resources this policy is designed to validate. The AdmissionPolicy cares about a request if it matches all Constraints. However, in order to prevent clusters from being put into an unstable state that cannot be recovered from via the API ValidatingAdmissionPolicy cannot match ValidatingAdmissionPolicy and ValidatingAdmissionPolicyBinding. Required.
    param_kind admissionregistration_k8s_io.v1beta1.ParamKind
    ParamKind specifies the kind of resources used to parameterize this policy. If absent, there are no parameters for this policy and the param CEL variable will not be provided to validation expressions. If ParamKind refers to a non-existent kind, this policy definition is mis-configured and the FailurePolicy is applied. If paramKind is specified but paramRef is unset in ValidatingAdmissionPolicyBinding, the params variable will be null.
    validations Sequence[admissionregistration_k8s_io.v1beta1.Validation]
    Validations contain CEL expressions which is used to apply the validation. Validations and AuditAnnotations may not both be empty; a minimum of one Validations or AuditAnnotations is required.
    variables Sequence[admissionregistration_k8s_io.v1beta1.Variable]

    Variables contain definitions of variables that can be used in composition of other expressions. Each variable is defined as a named CEL expression. The variables defined here will be available under variables in other expressions of the policy except MatchConditions because MatchConditions are evaluated before the rest of the policy.

    The expression of a variable can refer to other variables defined earlier in the list but not those after. Thus, Variables must be sorted by the order of first appearance and acyclic.

    auditAnnotations List<Property Map>
    auditAnnotations contains CEL expressions which are used to produce audit annotations for the audit event of the API request. validations and auditAnnotations may not both be empty; a least one of validations or auditAnnotations is required.
    failurePolicy String

    failurePolicy defines how to handle failures for the admission policy. Failures can occur from CEL expression parse errors, type check errors, runtime errors and invalid or mis-configured policy definitions or bindings.

    A policy is invalid if spec.paramKind refers to a non-existent Kind. A binding is invalid if spec.paramRef.name refers to a non-existent resource.

    failurePolicy does not define how validations that evaluate to false are handled.

    When failurePolicy is set to Fail, ValidatingAdmissionPolicyBinding validationActions define how failures are enforced.

    Allowed values are Ignore or Fail. Defaults to Fail.

    matchConditions List<Property Map>

    MatchConditions is a list of conditions that must be met for a request to be validated. Match conditions filter requests that have already been matched by the rules, namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests. There are a maximum of 64 match conditions allowed.

    If a parameter object is provided, it can be accessed via the params handle in the same manner as validation expressions.

    The exact matching logic is (in order):

    1. If ANY matchCondition evaluates to FALSE, the policy is skipped.
    2. If ALL matchConditions evaluate to TRUE, the policy is evaluated.
    3. If any matchCondition evaluates to an error (but none are FALSE):
      • If failurePolicy=Fail, reject the request
      • If failurePolicy=Ignore, the policy is skipped
    matchConstraints Property Map
    MatchConstraints specifies what resources this policy is designed to validate. The AdmissionPolicy cares about a request if it matches all Constraints. However, in order to prevent clusters from being put into an unstable state that cannot be recovered from via the API ValidatingAdmissionPolicy cannot match ValidatingAdmissionPolicy and ValidatingAdmissionPolicyBinding. Required.
    paramKind Property Map
    ParamKind specifies the kind of resources used to parameterize this policy. If absent, there are no parameters for this policy and the param CEL variable will not be provided to validation expressions. If ParamKind refers to a non-existent kind, this policy definition is mis-configured and the FailurePolicy is applied. If paramKind is specified but paramRef is unset in ValidatingAdmissionPolicyBinding, the params variable will be null.
    validations List<Property Map>
    Validations contain CEL expressions which is used to apply the validation. Validations and AuditAnnotations may not both be empty; a minimum of one Validations or AuditAnnotations is required.
    variables List<Property Map>

    Variables contain definitions of variables that can be used in composition of other expressions. Each variable is defined as a named CEL expression. The variables defined here will be available under variables in other expressions of the policy except MatchConditions because MatchConditions are evaluated before the rest of the policy.

    The expression of a variable can refer to other variables defined earlier in the list but not those after. Thus, Variables must be sorted by the order of first appearance and acyclic.

    ValidatingAdmissionPolicyStatus, ValidatingAdmissionPolicyStatusArgs

    Conditions List<Pulumi.Kubernetes.Meta.V1.Inputs.Condition>
    The conditions represent the latest available observations of a policy's current state.
    ObservedGeneration int
    The generation observed by the controller.
    TypeChecking TypeChecking
    The results of type checking for each expression. Presence of this field indicates the completion of the type checking.
    Conditions Condition
    The conditions represent the latest available observations of a policy's current state.
    ObservedGeneration int
    The generation observed by the controller.
    TypeChecking TypeChecking
    The results of type checking for each expression. Presence of this field indicates the completion of the type checking.
    conditions List<Condition>
    The conditions represent the latest available observations of a policy's current state.
    observedGeneration Integer
    The generation observed by the controller.
    typeChecking TypeChecking
    The results of type checking for each expression. Presence of this field indicates the completion of the type checking.
    conditions meta.v1.Condition[]
    The conditions represent the latest available observations of a policy's current state.
    observedGeneration number
    The generation observed by the controller.
    typeChecking TypeChecking
    The results of type checking for each expression. Presence of this field indicates the completion of the type checking.
    conditions Sequence[meta.v1.Condition]
    The conditions represent the latest available observations of a policy's current state.
    observed_generation int
    The generation observed by the controller.
    type_checking admissionregistration_k8s_io.v1beta1.TypeChecking
    The results of type checking for each expression. Presence of this field indicates the completion of the type checking.
    conditions List<Property Map>
    The conditions represent the latest available observations of a policy's current state.
    observedGeneration Number
    The generation observed by the controller.
    typeChecking Property Map
    The results of type checking for each expression. Presence of this field indicates the completion of the type checking.

    Validation, ValidationArgs

    Expression string

    Expression represents the expression which will be evaluated by CEL. ref: https://github.com/google/cel-spec CEL expressions have access to the contents of the API request/response, organized into CEL variables as well as some other useful variables:

    • 'object' - The object from the incoming request. The value is null for DELETE requests. - 'oldObject' - The existing object. The value is null for CREATE requests. - 'request' - Attributes of the API request(ref). - 'params' - Parameter resource referred to by the policy binding being evaluated. Only populated if the policy has a ParamKind. - 'namespaceObject' - The namespace object that the incoming object belongs to. The value is null for cluster-scoped resources. - 'variables' - Map of composited variables, from its name to its lazily evaluated value. For example, a variable named 'foo' can be accessed as 'variables.foo'.
    • 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz
    • 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the request resource.

    The apiVersion, kind, metadata.name and metadata.generateName are always accessible from the root of the object. No other metadata properties are accessible.

    Only property names of the form [a-zA-Z_.-/][a-zA-Z0-9_.-/]* are accessible. Accessible property names are escaped according to the following rules when accessed in the expression: - '' escapes to 'underscores' - '.' escapes to 'dot' - '-' escapes to 'dash' - '/' escapes to 'slash' - Property names that exactly match a CEL RESERVED keyword escape to '{keyword}__'. The keywords are: "true", "false", "null", "in", "as", "break", "const", "continue", "else", "for", "function", "if", "import", "let", "loop", "package", "namespace", "return". Examples:

    • Expression accessing a property named "namespace": {"Expression": "object.namespace > 0"}
    • Expression accessing a property named "x-prop": {"Expression": "object.x__dash__prop > 0"}
    • Expression accessing a property named "redact__d": {"Expression": "object.redact__underscores__d > 0"}

    Equality on arrays with list type of 'set' or 'map' ignores element order, i.e. [1, 2] == [2, 1]. Concatenation on arrays with x-kubernetes-list-type use the semantics of the list type:

    • 'set': X + Y performs a union where the array positions of all elements in X are preserved and non-intersecting elements in Y are appended, retaining their partial order.
    • 'map': X + Y performs a merge where the array positions of all keys in X are preserved but the values are overwritten by values in Y when the key sets of X and Y intersect. Elements in Y with non-intersecting keys are appended, retaining their partial order. Required.
    Message string
    Message represents the message displayed when validation fails. The message is required if the Expression contains line breaks. The message must not contain line breaks. If unset, the message is "failed rule: {Rule}". e.g. "must be a URL with the host matching spec.host" If the Expression contains line breaks. Message is required. The message must not contain line breaks. If unset, the message is "failed Expression: {Expression}".
    MessageExpression string
    messageExpression declares a CEL expression that evaluates to the validation failure message that is returned when this rule fails. Since messageExpression is used as a failure message, it must evaluate to a string. If both message and messageExpression are present on a validation, then messageExpression will be used if validation fails. If messageExpression results in a runtime error, the runtime error is logged, and the validation failure message is produced as if the messageExpression field were unset. If messageExpression evaluates to an empty string, a string with only spaces, or a string that contains line breaks, then the validation failure message will also be produced as if the messageExpression field were unset, and the fact that messageExpression produced an empty string/string with only spaces/string with line breaks will be logged. messageExpression has access to all the same variables as the expression except for 'authorizer' and 'authorizer.requestResource'. Example: "object.x must be less than max ("+string(params.max)+")"
    Reason string
    Reason represents a machine-readable description of why this validation failed. If this is the first validation in the list to fail, this reason, as well as the corresponding HTTP response code, are used in the HTTP response to the client. The currently supported reasons are: "Unauthorized", "Forbidden", "Invalid", "RequestEntityTooLarge". If not set, StatusReasonInvalid is used in the response to the client.
    Expression string

    Expression represents the expression which will be evaluated by CEL. ref: https://github.com/google/cel-spec CEL expressions have access to the contents of the API request/response, organized into CEL variables as well as some other useful variables:

    • 'object' - The object from the incoming request. The value is null for DELETE requests. - 'oldObject' - The existing object. The value is null for CREATE requests. - 'request' - Attributes of the API request(ref). - 'params' - Parameter resource referred to by the policy binding being evaluated. Only populated if the policy has a ParamKind. - 'namespaceObject' - The namespace object that the incoming object belongs to. The value is null for cluster-scoped resources. - 'variables' - Map of composited variables, from its name to its lazily evaluated value. For example, a variable named 'foo' can be accessed as 'variables.foo'.
    • 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz
    • 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the request resource.

    The apiVersion, kind, metadata.name and metadata.generateName are always accessible from the root of the object. No other metadata properties are accessible.

    Only property names of the form [a-zA-Z_.-/][a-zA-Z0-9_.-/]* are accessible. Accessible property names are escaped according to the following rules when accessed in the expression: - '' escapes to 'underscores' - '.' escapes to 'dot' - '-' escapes to 'dash' - '/' escapes to 'slash' - Property names that exactly match a CEL RESERVED keyword escape to '{keyword}__'. The keywords are: "true", "false", "null", "in", "as", "break", "const", "continue", "else", "for", "function", "if", "import", "let", "loop", "package", "namespace", "return". Examples:

    • Expression accessing a property named "namespace": {"Expression": "object.namespace > 0"}
    • Expression accessing a property named "x-prop": {"Expression": "object.x__dash__prop > 0"}
    • Expression accessing a property named "redact__d": {"Expression": "object.redact__underscores__d > 0"}

    Equality on arrays with list type of 'set' or 'map' ignores element order, i.e. [1, 2] == [2, 1]. Concatenation on arrays with x-kubernetes-list-type use the semantics of the list type:

    • 'set': X + Y performs a union where the array positions of all elements in X are preserved and non-intersecting elements in Y are appended, retaining their partial order.
    • 'map': X + Y performs a merge where the array positions of all keys in X are preserved but the values are overwritten by values in Y when the key sets of X and Y intersect. Elements in Y with non-intersecting keys are appended, retaining their partial order. Required.
    Message string
    Message represents the message displayed when validation fails. The message is required if the Expression contains line breaks. The message must not contain line breaks. If unset, the message is "failed rule: {Rule}". e.g. "must be a URL with the host matching spec.host" If the Expression contains line breaks. Message is required. The message must not contain line breaks. If unset, the message is "failed Expression: {Expression}".
    MessageExpression string
    messageExpression declares a CEL expression that evaluates to the validation failure message that is returned when this rule fails. Since messageExpression is used as a failure message, it must evaluate to a string. If both message and messageExpression are present on a validation, then messageExpression will be used if validation fails. If messageExpression results in a runtime error, the runtime error is logged, and the validation failure message is produced as if the messageExpression field were unset. If messageExpression evaluates to an empty string, a string with only spaces, or a string that contains line breaks, then the validation failure message will also be produced as if the messageExpression field were unset, and the fact that messageExpression produced an empty string/string with only spaces/string with line breaks will be logged. messageExpression has access to all the same variables as the expression except for 'authorizer' and 'authorizer.requestResource'. Example: "object.x must be less than max ("+string(params.max)+")"
    Reason string
    Reason represents a machine-readable description of why this validation failed. If this is the first validation in the list to fail, this reason, as well as the corresponding HTTP response code, are used in the HTTP response to the client. The currently supported reasons are: "Unauthorized", "Forbidden", "Invalid", "RequestEntityTooLarge". If not set, StatusReasonInvalid is used in the response to the client.
    expression String

    Expression represents the expression which will be evaluated by CEL. ref: https://github.com/google/cel-spec CEL expressions have access to the contents of the API request/response, organized into CEL variables as well as some other useful variables:

    • 'object' - The object from the incoming request. The value is null for DELETE requests. - 'oldObject' - The existing object. The value is null for CREATE requests. - 'request' - Attributes of the API request(ref). - 'params' - Parameter resource referred to by the policy binding being evaluated. Only populated if the policy has a ParamKind. - 'namespaceObject' - The namespace object that the incoming object belongs to. The value is null for cluster-scoped resources. - 'variables' - Map of composited variables, from its name to its lazily evaluated value. For example, a variable named 'foo' can be accessed as 'variables.foo'.
    • 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz
    • 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the request resource.

    The apiVersion, kind, metadata.name and metadata.generateName are always accessible from the root of the object. No other metadata properties are accessible.

    Only property names of the form [a-zA-Z_.-/][a-zA-Z0-9_.-/]* are accessible. Accessible property names are escaped according to the following rules when accessed in the expression: - '' escapes to 'underscores' - '.' escapes to 'dot' - '-' escapes to 'dash' - '/' escapes to 'slash' - Property names that exactly match a CEL RESERVED keyword escape to '{keyword}__'. The keywords are: "true", "false", "null", "in", "as", "break", "const", "continue", "else", "for", "function", "if", "import", "let", "loop", "package", "namespace", "return". Examples:

    • Expression accessing a property named "namespace": {"Expression": "object.namespace > 0"}
    • Expression accessing a property named "x-prop": {"Expression": "object.x__dash__prop > 0"}
    • Expression accessing a property named "redact__d": {"Expression": "object.redact__underscores__d > 0"}

    Equality on arrays with list type of 'set' or 'map' ignores element order, i.e. [1, 2] == [2, 1]. Concatenation on arrays with x-kubernetes-list-type use the semantics of the list type:

    • 'set': X + Y performs a union where the array positions of all elements in X are preserved and non-intersecting elements in Y are appended, retaining their partial order.
    • 'map': X + Y performs a merge where the array positions of all keys in X are preserved but the values are overwritten by values in Y when the key sets of X and Y intersect. Elements in Y with non-intersecting keys are appended, retaining their partial order. Required.
    message String
    Message represents the message displayed when validation fails. The message is required if the Expression contains line breaks. The message must not contain line breaks. If unset, the message is "failed rule: {Rule}". e.g. "must be a URL with the host matching spec.host" If the Expression contains line breaks. Message is required. The message must not contain line breaks. If unset, the message is "failed Expression: {Expression}".
    messageExpression String
    messageExpression declares a CEL expression that evaluates to the validation failure message that is returned when this rule fails. Since messageExpression is used as a failure message, it must evaluate to a string. If both message and messageExpression are present on a validation, then messageExpression will be used if validation fails. If messageExpression results in a runtime error, the runtime error is logged, and the validation failure message is produced as if the messageExpression field were unset. If messageExpression evaluates to an empty string, a string with only spaces, or a string that contains line breaks, then the validation failure message will also be produced as if the messageExpression field were unset, and the fact that messageExpression produced an empty string/string with only spaces/string with line breaks will be logged. messageExpression has access to all the same variables as the expression except for 'authorizer' and 'authorizer.requestResource'. Example: "object.x must be less than max ("+string(params.max)+")"
    reason String
    Reason represents a machine-readable description of why this validation failed. If this is the first validation in the list to fail, this reason, as well as the corresponding HTTP response code, are used in the HTTP response to the client. The currently supported reasons are: "Unauthorized", "Forbidden", "Invalid", "RequestEntityTooLarge". If not set, StatusReasonInvalid is used in the response to the client.
    expression string

    Expression represents the expression which will be evaluated by CEL. ref: https://github.com/google/cel-spec CEL expressions have access to the contents of the API request/response, organized into CEL variables as well as some other useful variables:

    • 'object' - The object from the incoming request. The value is null for DELETE requests. - 'oldObject' - The existing object. The value is null for CREATE requests. - 'request' - Attributes of the API request(ref). - 'params' - Parameter resource referred to by the policy binding being evaluated. Only populated if the policy has a ParamKind. - 'namespaceObject' - The namespace object that the incoming object belongs to. The value is null for cluster-scoped resources. - 'variables' - Map of composited variables, from its name to its lazily evaluated value. For example, a variable named 'foo' can be accessed as 'variables.foo'.
    • 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz
    • 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the request resource.

    The apiVersion, kind, metadata.name and metadata.generateName are always accessible from the root of the object. No other metadata properties are accessible.

    Only property names of the form [a-zA-Z_.-/][a-zA-Z0-9_.-/]* are accessible. Accessible property names are escaped according to the following rules when accessed in the expression: - '' escapes to 'underscores' - '.' escapes to 'dot' - '-' escapes to 'dash' - '/' escapes to 'slash' - Property names that exactly match a CEL RESERVED keyword escape to '{keyword}__'. The keywords are: "true", "false", "null", "in", "as", "break", "const", "continue", "else", "for", "function", "if", "import", "let", "loop", "package", "namespace", "return". Examples:

    • Expression accessing a property named "namespace": {"Expression": "object.namespace > 0"}
    • Expression accessing a property named "x-prop": {"Expression": "object.x__dash__prop > 0"}
    • Expression accessing a property named "redact__d": {"Expression": "object.redact__underscores__d > 0"}

    Equality on arrays with list type of 'set' or 'map' ignores element order, i.e. [1, 2] == [2, 1]. Concatenation on arrays with x-kubernetes-list-type use the semantics of the list type:

    • 'set': X + Y performs a union where the array positions of all elements in X are preserved and non-intersecting elements in Y are appended, retaining their partial order.
    • 'map': X + Y performs a merge where the array positions of all keys in X are preserved but the values are overwritten by values in Y when the key sets of X and Y intersect. Elements in Y with non-intersecting keys are appended, retaining their partial order. Required.
    message string
    Message represents the message displayed when validation fails. The message is required if the Expression contains line breaks. The message must not contain line breaks. If unset, the message is "failed rule: {Rule}". e.g. "must be a URL with the host matching spec.host" If the Expression contains line breaks. Message is required. The message must not contain line breaks. If unset, the message is "failed Expression: {Expression}".
    messageExpression string
    messageExpression declares a CEL expression that evaluates to the validation failure message that is returned when this rule fails. Since messageExpression is used as a failure message, it must evaluate to a string. If both message and messageExpression are present on a validation, then messageExpression will be used if validation fails. If messageExpression results in a runtime error, the runtime error is logged, and the validation failure message is produced as if the messageExpression field were unset. If messageExpression evaluates to an empty string, a string with only spaces, or a string that contains line breaks, then the validation failure message will also be produced as if the messageExpression field were unset, and the fact that messageExpression produced an empty string/string with only spaces/string with line breaks will be logged. messageExpression has access to all the same variables as the expression except for 'authorizer' and 'authorizer.requestResource'. Example: "object.x must be less than max ("+string(params.max)+")"
    reason string
    Reason represents a machine-readable description of why this validation failed. If this is the first validation in the list to fail, this reason, as well as the corresponding HTTP response code, are used in the HTTP response to the client. The currently supported reasons are: "Unauthorized", "Forbidden", "Invalid", "RequestEntityTooLarge". If not set, StatusReasonInvalid is used in the response to the client.
    expression str

    Expression represents the expression which will be evaluated by CEL. ref: https://github.com/google/cel-spec CEL expressions have access to the contents of the API request/response, organized into CEL variables as well as some other useful variables:

    • 'object' - The object from the incoming request. The value is null for DELETE requests. - 'oldObject' - The existing object. The value is null for CREATE requests. - 'request' - Attributes of the API request(ref). - 'params' - Parameter resource referred to by the policy binding being evaluated. Only populated if the policy has a ParamKind. - 'namespaceObject' - The namespace object that the incoming object belongs to. The value is null for cluster-scoped resources. - 'variables' - Map of composited variables, from its name to its lazily evaluated value. For example, a variable named 'foo' can be accessed as 'variables.foo'.
    • 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz
    • 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the request resource.

    The apiVersion, kind, metadata.name and metadata.generateName are always accessible from the root of the object. No other metadata properties are accessible.

    Only property names of the form [a-zA-Z_.-/][a-zA-Z0-9_.-/]* are accessible. Accessible property names are escaped according to the following rules when accessed in the expression: - '' escapes to 'underscores' - '.' escapes to 'dot' - '-' escapes to 'dash' - '/' escapes to 'slash' - Property names that exactly match a CEL RESERVED keyword escape to '{keyword}__'. The keywords are: "true", "false", "null", "in", "as", "break", "const", "continue", "else", "for", "function", "if", "import", "let", "loop", "package", "namespace", "return". Examples:

    • Expression accessing a property named "namespace": {"Expression": "object.namespace > 0"}
    • Expression accessing a property named "x-prop": {"Expression": "object.x__dash__prop > 0"}
    • Expression accessing a property named "redact__d": {"Expression": "object.redact__underscores__d > 0"}

    Equality on arrays with list type of 'set' or 'map' ignores element order, i.e. [1, 2] == [2, 1]. Concatenation on arrays with x-kubernetes-list-type use the semantics of the list type:

    • 'set': X + Y performs a union where the array positions of all elements in X are preserved and non-intersecting elements in Y are appended, retaining their partial order.
    • 'map': X + Y performs a merge where the array positions of all keys in X are preserved but the values are overwritten by values in Y when the key sets of X and Y intersect. Elements in Y with non-intersecting keys are appended, retaining their partial order. Required.
    message str
    Message represents the message displayed when validation fails. The message is required if the Expression contains line breaks. The message must not contain line breaks. If unset, the message is "failed rule: {Rule}". e.g. "must be a URL with the host matching spec.host" If the Expression contains line breaks. Message is required. The message must not contain line breaks. If unset, the message is "failed Expression: {Expression}".
    message_expression str
    messageExpression declares a CEL expression that evaluates to the validation failure message that is returned when this rule fails. Since messageExpression is used as a failure message, it must evaluate to a string. If both message and messageExpression are present on a validation, then messageExpression will be used if validation fails. If messageExpression results in a runtime error, the runtime error is logged, and the validation failure message is produced as if the messageExpression field were unset. If messageExpression evaluates to an empty string, a string with only spaces, or a string that contains line breaks, then the validation failure message will also be produced as if the messageExpression field were unset, and the fact that messageExpression produced an empty string/string with only spaces/string with line breaks will be logged. messageExpression has access to all the same variables as the expression except for 'authorizer' and 'authorizer.requestResource'. Example: "object.x must be less than max ("+string(params.max)+")"
    reason str
    Reason represents a machine-readable description of why this validation failed. If this is the first validation in the list to fail, this reason, as well as the corresponding HTTP response code, are used in the HTTP response to the client. The currently supported reasons are: "Unauthorized", "Forbidden", "Invalid", "RequestEntityTooLarge". If not set, StatusReasonInvalid is used in the response to the client.
    expression String

    Expression represents the expression which will be evaluated by CEL. ref: https://github.com/google/cel-spec CEL expressions have access to the contents of the API request/response, organized into CEL variables as well as some other useful variables:

    • 'object' - The object from the incoming request. The value is null for DELETE requests. - 'oldObject' - The existing object. The value is null for CREATE requests. - 'request' - Attributes of the API request(ref). - 'params' - Parameter resource referred to by the policy binding being evaluated. Only populated if the policy has a ParamKind. - 'namespaceObject' - The namespace object that the incoming object belongs to. The value is null for cluster-scoped resources. - 'variables' - Map of composited variables, from its name to its lazily evaluated value. For example, a variable named 'foo' can be accessed as 'variables.foo'.
    • 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz
    • 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the request resource.

    The apiVersion, kind, metadata.name and metadata.generateName are always accessible from the root of the object. No other metadata properties are accessible.

    Only property names of the form [a-zA-Z_.-/][a-zA-Z0-9_.-/]* are accessible. Accessible property names are escaped according to the following rules when accessed in the expression: - '' escapes to 'underscores' - '.' escapes to 'dot' - '-' escapes to 'dash' - '/' escapes to 'slash' - Property names that exactly match a CEL RESERVED keyword escape to '{keyword}__'. The keywords are: "true", "false", "null", "in", "as", "break", "const", "continue", "else", "for", "function", "if", "import", "let", "loop", "package", "namespace", "return". Examples:

    • Expression accessing a property named "namespace": {"Expression": "object.namespace > 0"}
    • Expression accessing a property named "x-prop": {"Expression": "object.x__dash__prop > 0"}
    • Expression accessing a property named "redact__d": {"Expression": "object.redact__underscores__d > 0"}

    Equality on arrays with list type of 'set' or 'map' ignores element order, i.e. [1, 2] == [2, 1]. Concatenation on arrays with x-kubernetes-list-type use the semantics of the list type:

    • 'set': X + Y performs a union where the array positions of all elements in X are preserved and non-intersecting elements in Y are appended, retaining their partial order.
    • 'map': X + Y performs a merge where the array positions of all keys in X are preserved but the values are overwritten by values in Y when the key sets of X and Y intersect. Elements in Y with non-intersecting keys are appended, retaining their partial order. Required.
    message String
    Message represents the message displayed when validation fails. The message is required if the Expression contains line breaks. The message must not contain line breaks. If unset, the message is "failed rule: {Rule}". e.g. "must be a URL with the host matching spec.host" If the Expression contains line breaks. Message is required. The message must not contain line breaks. If unset, the message is "failed Expression: {Expression}".
    messageExpression String
    messageExpression declares a CEL expression that evaluates to the validation failure message that is returned when this rule fails. Since messageExpression is used as a failure message, it must evaluate to a string. If both message and messageExpression are present on a validation, then messageExpression will be used if validation fails. If messageExpression results in a runtime error, the runtime error is logged, and the validation failure message is produced as if the messageExpression field were unset. If messageExpression evaluates to an empty string, a string with only spaces, or a string that contains line breaks, then the validation failure message will also be produced as if the messageExpression field were unset, and the fact that messageExpression produced an empty string/string with only spaces/string with line breaks will be logged. messageExpression has access to all the same variables as the expression except for 'authorizer' and 'authorizer.requestResource'. Example: "object.x must be less than max ("+string(params.max)+")"
    reason String
    Reason represents a machine-readable description of why this validation failed. If this is the first validation in the list to fail, this reason, as well as the corresponding HTTP response code, are used in the HTTP response to the client. The currently supported reasons are: "Unauthorized", "Forbidden", "Invalid", "RequestEntityTooLarge". If not set, StatusReasonInvalid is used in the response to the client.

    Variable, VariableArgs

    Expression string
    Expression is the expression that will be evaluated as the value of the variable. The CEL expression has access to the same identifiers as the CEL expressions in Validation.
    Name string
    Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. The variable can be accessed in other expressions through variables For example, if name is "foo", the variable will be available as variables.foo
    Expression string
    Expression is the expression that will be evaluated as the value of the variable. The CEL expression has access to the same identifiers as the CEL expressions in Validation.
    Name string
    Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. The variable can be accessed in other expressions through variables For example, if name is "foo", the variable will be available as variables.foo
    expression String
    Expression is the expression that will be evaluated as the value of the variable. The CEL expression has access to the same identifiers as the CEL expressions in Validation.
    name String
    Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. The variable can be accessed in other expressions through variables For example, if name is "foo", the variable will be available as variables.foo
    expression string
    Expression is the expression that will be evaluated as the value of the variable. The CEL expression has access to the same identifiers as the CEL expressions in Validation.
    name string
    Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. The variable can be accessed in other expressions through variables For example, if name is "foo", the variable will be available as variables.foo
    expression str
    Expression is the expression that will be evaluated as the value of the variable. The CEL expression has access to the same identifiers as the CEL expressions in Validation.
    name str
    Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. The variable can be accessed in other expressions through variables For example, if name is "foo", the variable will be available as variables.foo
    expression String
    Expression is the expression that will be evaluated as the value of the variable. The CEL expression has access to the same identifiers as the CEL expressions in Validation.
    name String
    Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. The variable can be accessed in other expressions through variables For example, if name is "foo", the variable will be available as variables.foo

    Package Details

    Repository
    Kubernetes pulumi/pulumi-kubernetes
    License
    Apache-2.0
    kubernetes logo
    Kubernetes v4.18.1 published on Friday, Sep 13, 2024 by Pulumi