ValidatingAdmissionPolicy describes the definition of an admission validation policy that accepts or rejects an object without changing it.

APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources

Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds

ValidatingAdmissionPolicySpec is the specification of the desired behavior of the AdmissionPolicy.

FailurePolicy defines how to handle failures for the admission policy. Failures can occur from invalid or mis-configured policy definitions or bindings. A policy is invalid if spec.paramKind refers to a non-existent Kind. A binding is invalid if spec.paramRef.name refers to a non-existent resource. Allowed values are Ignore or Fail. Defaults to Fail.

MatchResources decides whether to run the admission control policy on an object based on whether it meets the match criteria. The exclude rules take precedence over include rules (if a resource matches both, it is excluded)

MatchConstraints specifies what resources this policy is designed to validate. The AdmissionPolicy cares about a request if it matches _all_ Constraints. However, in order to prevent clusters from being put into an unstable state that cannot be recovered from via the API ValidatingAdmissionPolicy cannot match ValidatingAdmissionPolicy and ValidatingAdmissionPolicyBinding. Required.

ParamKind is a tuple of Group Kind and Version.

ParamKind specifies the kind of resources used to parameterize this policy. If absent, there are no parameters for this policy and the param CEL variable will not be provided to validation expressions. If ParamKind refers to a non-existent kind, this policy definition is mis-configured and the FailurePolicy is applied. If paramKind is specified but paramRef is unset in ValidatingAdmissionPolicyBinding, the params variable will be null.

Validation specifies the CEL expression which is used to apply the validation.

Validations contain CEL expressions which is used to apply the validation. A minimum of one validation is required for a policy definition. Required.

Specification of the desired behavior of the ValidatingAdmissionPolicy.

admissionregistration.k8s.io/v1alpha1 · Cluster Resource

ValidatingAdmissionPolicy

We don't have any examples of ValidatingAdmissionPolicy yet 😕

Other useful resources

Tired of using Kubectl? 😓