|
| 1 | +""" |
| 2 | +This file was generated by the KCL auto-gen tool. DO NOT EDIT. |
| 3 | +Editing this file might prove futile when you re-run the KCL auto-gen generate command. |
| 4 | +""" |
| 5 | +import k8s.apimachinery.pkg.apis.meta.v1 |
| 6 | + |
| 7 | + |
| 8 | +schema GlobalNetworkPolicy: |
| 9 | + """ |
| 10 | + crd projectcalico org v1 global network policy |
| 11 | + |
| 12 | + Attributes |
| 13 | + ---------- |
| 14 | + action : str, default is Undefined, optional |
| 15 | + action |
| 16 | + apiVersion : str, default is "crd.projectcalico.org/v1", required |
| 17 | + APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources |
| 18 | + kind : str, default is "GlobalNetworkPolicy", required |
| 19 | + Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |
| 20 | + destination : CrdProjectcalicoOrgV1GlobalNetworkPolicyDestination, default is Undefined, optional |
| 21 | + destination |
| 22 | + metadata : v1.ObjectMeta, default is Undefined, optional |
| 23 | + metadata |
| 24 | + """ |
| 25 | + |
| 26 | + |
| 27 | + action?: str |
| 28 | + |
| 29 | + apiVersion: "crd.projectcalico.org/v1" = "crd.projectcalico.org/v1" |
| 30 | + |
| 31 | + kind: "GlobalNetworkPolicy" = "GlobalNetworkPolicy" |
| 32 | + |
| 33 | + destination?: CrdProjectcalicoOrgV1GlobalNetworkPolicyDestination |
| 34 | + |
| 35 | + metadata?: v1.ObjectMeta |
| 36 | + |
| 37 | + |
| 38 | +schema CrdProjectcalicoOrgV1GlobalNetworkPolicyDestination: |
| 39 | + """ |
| 40 | + Destination contains the match criteria that apply to destination entity. |
| 41 | + |
| 42 | + Attributes |
| 43 | + ---------- |
| 44 | + namespaceSelector : str, default is Undefined, optional |
| 45 | + NamespaceSelector is an optional field that contains a selector expression. Only traffic that originates from (or terminates at) endpoints within the selected namespaces will be matched. When both NamespaceSelector and another selector are defined on the same rule, then only workload endpoints that are matched by both selectors will be selected by the rule. |
| 46 | + For NetworkPolicy, an empty NamespaceSelector implies that the Selector is limited to selecting only workload endpoints in the same namespace as the NetworkPolicy. |
| 47 | + For NetworkPolicy, `global()` NamespaceSelector implies that the Selector is limited to selecting only GlobalNetworkSet or HostEndpoint. |
| 48 | + For GlobalNetworkPolicy, an empty NamespaceSelector implies the Selector applies to workload endpoints across all namespaces. |
| 49 | + nets : [str], default is Undefined, optional |
| 50 | + Nets is an optional field that restricts the rule to only apply to traffic that originates from (or terminates at) IP addresses in any of the given subnets. |
| 51 | + notNets : [str], default is Undefined, optional |
| 52 | + NotNets is the negated version of the Nets field. |
| 53 | + notPorts : [int | str], default is Undefined, optional |
| 54 | + NotPorts is the negated version of the Ports field. Since only some protocols have ports, if any ports are specified it requires the Protocol match in the Rule to be set to "TCP" or "UDP". |
| 55 | + notSelector : str, default is Undefined, optional |
| 56 | + NotSelector is the negated version of the Selector field. See Selector field for subtleties with negated selectors. |
| 57 | + ports : [int | str], default is Undefined, optional |
| 58 | + Ports is an optional field that restricts the rule to only apply to traffic that has a source (destination) port that matches one of these ranges/values. This value is a list of integers or strings that represent ranges of ports. |
| 59 | + Since only some protocols have ports, if any ports are specified it requires the Protocol match in the Rule to be set to "TCP" or "UDP". |
| 60 | + selector : str, default is Undefined, optional |
| 61 | + Selector is an optional field that contains a selector expression (see Policy for sample syntax). Only traffic that originates from (terminates at) endpoints matching the selector will be matched. |
| 62 | + Note that: in addition to the negated version of the Selector (see NotSelector below), the selector expression syntax itself supports negation. The two types of negation are subtly different. One negates the set of matched endpoints, the other negates the whole match: |
| 63 | + Selector = "!has(my_label)" matches packets that are from other Calico-controlled endpoints that do not have the label "my_label". |
| 64 | + NotSelector = "has(my_label)" matches packets that are not from Calico-controlled endpoints that do have the label "my_label". |
| 65 | + The effect is that the latter will accept packets from non-Calico sources whereas the former is limited to packets from Calico-controlled endpoints. |
| 66 | + serviceAccounts : CrdProjectcalicoOrgV1GlobalNetworkPolicyDestinationServiceAccounts, default is Undefined, optional |
| 67 | + service accounts |
| 68 | + services : CrdProjectcalicoOrgV1GlobalNetworkPolicyDestinationServices, default is Undefined, optional |
| 69 | + services |
| 70 | + """ |
| 71 | + |
| 72 | + |
| 73 | + namespaceSelector?: str |
| 74 | + |
| 75 | + nets?: [str] |
| 76 | + |
| 77 | + notNets?: [str] |
| 78 | + |
| 79 | + notPorts?: [int | str] |
| 80 | + |
| 81 | + notSelector?: str |
| 82 | + |
| 83 | + ports?: [int | str] |
| 84 | + |
| 85 | + selector?: str |
| 86 | + |
| 87 | + serviceAccounts?: CrdProjectcalicoOrgV1GlobalNetworkPolicyDestinationServiceAccounts |
| 88 | + |
| 89 | + services?: CrdProjectcalicoOrgV1GlobalNetworkPolicyDestinationServices |
| 90 | + |
| 91 | + |
| 92 | +schema CrdProjectcalicoOrgV1GlobalNetworkPolicyDestinationServiceAccounts: |
| 93 | + """ |
| 94 | + ServiceAccounts is an optional field that restricts the rule to only apply to traffic that originates from (or terminates at) a pod running as a matching service account. |
| 95 | + |
| 96 | + Attributes |
| 97 | + ---------- |
| 98 | + names : [str], default is Undefined, optional |
| 99 | + Names is an optional field that restricts the rule to only apply to traffic that originates from (or terminates at) a pod running as a service account whose name is in the list. |
| 100 | + selector : str, default is Undefined, optional |
| 101 | + Selector is an optional field that restricts the rule to only apply to traffic that originates from (or terminates at) a pod running as a service account that matches the given label selector. If both Names and Selector are specified then they are AND'ed. |
| 102 | + """ |
| 103 | + |
| 104 | + |
| 105 | + names?: [str] |
| 106 | + |
| 107 | + selector?: str |
| 108 | + |
| 109 | + |
| 110 | +schema CrdProjectcalicoOrgV1GlobalNetworkPolicyDestinationServices: |
| 111 | + """ |
| 112 | + Services is an optional field that contains options for matching Kubernetes Services. If specified, only traffic that originates from or terminates at endpoints within the selected service(s) will be matched, and only to/from each endpoint's port. |
| 113 | + Services cannot be specified on the same rule as Selector, NotSelector, NamespaceSelector, Nets, NotNets or ServiceAccounts. |
| 114 | + Ports and NotPorts can only be specified with Services on ingress rules. |
| 115 | + |
| 116 | + Attributes |
| 117 | + ---------- |
| 118 | + name : str, default is Undefined, optional |
| 119 | + Name specifies the name of a Kubernetes Service to match. |
| 120 | + namespace : str, default is Undefined, optional |
| 121 | + Namespace specifies the namespace of the given Service. If left empty, the rule will match within this policy's namespace. |
| 122 | + """ |
| 123 | + |
| 124 | + |
| 125 | + name?: str |
| 126 | + |
| 127 | + namespace?: str |
| 128 | + |
| 129 | + |
0 commit comments