2 Copyright The Kubernetes Authors.
4 Licensed under the Apache License, Version 2.0 (the "License");
5 you may not use this file except in compliance with the License.
6 You may obtain a copy of the License at
8 http://www.apache.org/licenses/LICENSE-2.0
10 Unless required by applicable law or agreed to in writing, software
11 distributed under the License is distributed on an "AS IS" BASIS,
12 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 See the License for the specific language governing permissions and
14 limitations under the License.
18 // This file was autogenerated by go-to-protobuf. Do not edit it manually!
22 package k8s.io.api.auditregistration.v1alpha1;
24 import "k8s.io/apimachinery/pkg/apis/meta/v1/generated.proto";
25 import "k8s.io/apimachinery/pkg/runtime/generated.proto";
26 import "k8s.io/apimachinery/pkg/runtime/schema/generated.proto";
28 // Package-wide variables from generator "generated".
29 option go_package = "v1alpha1";
31 // AuditSink represents a cluster level audit sink
34 optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
36 // Spec defines the audit configuration spec
37 optional AuditSinkSpec spec = 2;
40 // AuditSinkList is a list of AuditSink items.
41 message AuditSinkList {
43 optional k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;
45 // List of audit configurations.
46 repeated AuditSink items = 2;
49 // AuditSinkSpec holds the spec for the audit sink
50 message AuditSinkSpec {
51 // Policy defines the policy for selecting which events should be sent to the webhook
53 optional Policy policy = 1;
55 // Webhook to send events
57 optional Webhook webhook = 2;
60 // Policy defines the configuration of how audit events are logged
62 // The Level that all requests are recorded at.
63 // available options: None, Metadata, Request, RequestResponse
65 optional string level = 1;
67 // Stages is a list of stages for which events are created.
69 repeated string stages = 2;
72 // ServiceReference holds a reference to Service.legacy.k8s.io
73 message ServiceReference {
74 // `namespace` is the namespace of the service.
76 optional string namespace = 1;
78 // `name` is the name of the service.
80 optional string name = 2;
82 // `path` is an optional URL path which will be sent in any request to
85 optional string path = 3;
88 // Webhook holds the configuration of the webhook
90 // Throttle holds the options for throttling the webhook
92 optional WebhookThrottleConfig throttle = 1;
94 // ClientConfig holds the connection parameters for the webhook
96 optional WebhookClientConfig clientConfig = 2;
99 // WebhookClientConfig contains the information to make a connection with the webhook
100 message WebhookClientConfig {
101 // `url` gives the location of the webhook, in standard URL form
102 // (`scheme://host:port/path`). Exactly one of `url` or `service`
103 // must be specified.
105 // The `host` should not refer to a service running in the cluster; use
106 // the `service` field instead. The host might be resolved via external
107 // DNS in some apiservers (e.g., `kube-apiserver` cannot resolve
108 // in-cluster DNS as that would be a layering violation). `host` may
109 // also be an IP address.
111 // Please note that using `localhost` or `127.0.0.1` as a `host` is
112 // risky unless you take great care to run this webhook on all hosts
113 // which run an apiserver which might need to make calls to this
114 // webhook. Such installs are likely to be non-portable, i.e., not easy
115 // to turn up in a new cluster.
117 // The scheme must be "https"; the URL must begin with "https://".
119 // A path is optional, and if present may be any string permissible in
120 // a URL. You may use the path to pass an arbitrary string to the
121 // webhook, for example, a cluster identifier.
123 // Attempting to use a user or basic auth e.g. "user:password@" is not
124 // allowed. Fragments ("#...") and query parameters ("?...") are not
128 optional string url = 1;
130 // `service` is a reference to the service for this webhook. Either
131 // `service` or `url` must be specified.
133 // If the webhook is running within the cluster, then you should use `service`.
135 // Port 443 will be used if it is open, otherwise it is an error.
138 optional ServiceReference service = 2;
140 // `caBundle` is a PEM encoded CA bundle which will be used to validate the webhook's server certificate.
141 // If unspecified, system trust roots on the apiserver are used.
143 optional bytes caBundle = 3;
146 // WebhookThrottleConfig holds the configuration for throttling events
147 message WebhookThrottleConfig {
148 // ThrottleQPS maximum number of batches per second
151 optional int64 qps = 1;
153 // ThrottleBurst is the maximum number of events sent at the same moment
156 optional int64 burst = 2;