FlowSchemaSpec

io.k8s.api.flowcontrol.v1.FlowSchemaSpec source ↗

FlowSchemaSpec describes how the FlowSchema's specification looks like.

distinguisherMethodFlowDistinguisherMethod`distinguisherMethod` defines how to compute the flow distinguisher for requests that match this schema. `nil` specifies that the distinguisher is disabled and thus will always be the empty string.
typestring required`type` is the type of flow distinguisher method The supported types are "ByUser" and "ByNamespace". Required.
matchingPrecedenceinteger (int32)`matchingPrecedence` is used to choose among the FlowSchemas that match a given request. The chosen FlowSchema is among those with the numerically lowest (which we take to be logically highest) MatchingPrecedence. Each MatchingPrecedence value must be ranged in [1,10000]. Note that if the precedence is not specified, it will be set to 1000 as default.
priorityLevelConfigurationPriorityLevelConfigurationReference required`priorityLevelConfiguration` should reference a PriorityLevelConfiguration in the cluster. If the reference cannot be resolved, the FlowSchema will be ignored and marked as invalid in its status. Required.
namestring required`name` is the name of the priority level configuration being referenced Required.
rules[]PolicyRulesWithSubjects`rules` describes which requests will match this flow schema. This FlowSchema matches a request if and only if at least one member of rules matches the request. if it is an empty slice, there will be no requests matching the FlowSchema.
nonResourceRules[]NonResourcePolicyRule`nonResourceRules` is a list of NonResourcePolicyRules that identify matching requests according to their verb and the target non-resource URL.
nonResourceURLs[]string required`nonResourceURLs` is a set of url prefixes that a user should have access to and may not be empty. For example:
  • "/healthz" is legal
  • "/hea*" is illegal
  • "/hea" is legal but matches nothing
  • "/hea/*" also matches nothing
  • "/healthz/*" matches all per-component health checks.
"*" matches all non-resource urls. if it is present, it must be the only entry. Required.
verbs[]string required`verbs` is a list of matching verbs and may not be empty. "*" matches all verbs. If it is present, it must be the only entry. Required.
resourceRules[]ResourcePolicyRule`resourceRules` is a slice of ResourcePolicyRules that identify matching requests according to their verb and the target resource. At least one of `resourceRules` and `nonResourceRules` has to be non-empty.
apiGroups[]string required`apiGroups` is a list of matching API groups and may not be empty. "*" matches all API groups and, if present, must be the only entry. Required.
clusterScopeboolean`clusterScope` indicates whether to match requests that do not specify a namespace (which happens either because the resource is not namespaced or the request targets all namespaces). If this field is omitted or false then the `namespaces` field must contain a non-empty list.
namespaces[]string`namespaces` is a list of target namespaces that restricts matches. A request that specifies a target namespace matches only if either (a) this list contains that target namespace or (b) this list contains "*". Note that "*" matches any specified namespace but does not match a request that _does not specify_ a namespace (see the `clusterScope` field for that). This list may be empty, but only if `clusterScope` is true.
resources[]string required`resources` is a list of matching resources (i.e., lowercase and plural) with, if desired, subresource. For example, [ "services", "nodes/status" ]. This list may not be empty. "*" matches all resources and, if present, must be the only entry. Required.
verbs[]string required`verbs` is a list of matching verbs and may not be empty. "*" matches all verbs and, if present, must be the only entry. Required.
subjects[]Subject requiredsubjects is the list of normal user, serviceaccount, or group that this rule cares about. There must be at least one member in this slice. A slice that includes both the system:authenticated and system:unauthenticated user groups matches every request. Required.
groupGroupSubject`group` matches based on user group name.
namestring requiredname is the user group that matches, or "*" to match all user groups. See https://github.com/kubernetes/apiserver/blob/master/pkg/authentication/user/user.go for some well-known group names. Required.
kindstring required`kind` indicates which one of the other fields is non-empty. Required
serviceAccountServiceAccountSubject`serviceAccount` matches ServiceAccounts.
namestring required`name` is the name of matching ServiceAccount objects, or "*" to match regardless of name. Required.
namespacestring required`namespace` is the namespace of matching ServiceAccount objects. Required.
userUserSubject`user` matches based on username.
namestring required`name` is the username that matches, or "*" to match all usernames. Required.