|
4 | 4 | package v1beta2 |
5 | 5 |
|
6 | 6 | import ( |
| 7 | + admissionregistrationv1 "k8s.io/api/admissionregistration/v1" |
7 | 8 | metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" |
8 | 9 |
|
9 | 10 | "github.com/projectcapsule/capsule/pkg/api" |
@@ -53,6 +54,50 @@ type CapsuleConfigurationSpec struct { |
53 | 54 | // for interacting with namespaces. Because if that label is not defined, it's assumed that namespace interaction was not targeted towards a tenant and will therefor |
54 | 55 | // be ignored by capsule. |
55 | 56 | Administrators api.UserListSpec `json:"administrators,omitempty"` |
| 57 | + // Configuration for dynamic Validating and Mutating Admission webhooks managed by Capsule. |
| 58 | + Admission DynamicAdmission `json:"admission,omitempty"` |
| 59 | + // Define Properties for managed ClusterRoles by Capsule |
| 60 | + // +kubebuilder:default={} |
| 61 | + RBAC *RBACConfiguration `json:"rbac"` |
| 62 | + // Define the period of time upon a cache invalidation is executed for all caches. |
| 63 | + // +kubebuilder:default="24h" |
| 64 | + CacheInvalidation metav1.Duration `json:"cacheInvalidation"` |
| 65 | +} |
| 66 | + |
| 67 | +type RBACConfiguration struct { |
| 68 | + // The ClusterRoles applied for Administrators |
| 69 | + // +kubebuilder:default={capsule-namespace-deleter} |
| 70 | + AdministrationClusterRoles []string `json:"administrationClusterRoles,omitempty"` |
| 71 | + // The ClusterRoles applied for ServiceAccounts which had owner Promotion |
| 72 | + // +kubebuilder:default={capsule-namespace-provisioner,capsule-namespace-deleter} |
| 73 | + PromotionClusterRoles []string `json:"promotionClusterRoles,omitempty"` |
| 74 | + // Name for the ClusterRole required to grant Namespace Deletion permissions. |
| 75 | + // +kubebuilder:default=capsule-namespace-deleter |
| 76 | + DeleterClusterRole string `json:"deleter,omitempty"` |
| 77 | + // Name for the ClusterRole required to grant Namespace Provision permissions. |
| 78 | + // +kubebuilder:default=capsule-namespace-provisioner |
| 79 | + ProvisionerClusterRole string `json:"provisioner,omitempty"` |
| 80 | +} |
| 81 | + |
| 82 | +type DynamicAdmission struct { |
| 83 | + // Configure dynamic Mutating Admission for Capsule |
| 84 | + Mutating DynamicAdmissionConfig `json:"mutating,omitempty"` |
| 85 | + |
| 86 | + // Configure dynamic Validating Admission for Capsule |
| 87 | + Validating DynamicAdmissionConfig `json:"validating,omitempty"` |
| 88 | +} |
| 89 | + |
| 90 | +type DynamicAdmissionConfig struct { |
| 91 | + // Name the Admission Webhook |
| 92 | + Name api.Name `json:"name,omitempty"` |
| 93 | + // Labels added to the Admission Webhook |
| 94 | + // +optional |
| 95 | + Labels map[string]string `json:"labels,omitempty"` |
| 96 | + // Annotations added to the Admission Webhook |
| 97 | + // +optional |
| 98 | + Annotations map[string]string `json:"annotations,omitempty"` |
| 99 | + // From the upstram struct |
| 100 | + Client admissionregistrationv1.WebhookClientConfig `json:"client"` |
56 | 101 | } |
57 | 102 |
|
58 | 103 | type NodeMetadata struct { |
|
0 commit comments