kubernetes reference title PodDisruptionBudget import k8s io api policy v1 weight 5 PodDisruptionBudget is an object to define the max disruption that can be caused to a collection of pods kind PodDisruptionBudget contenttype apireference apimetadata autogenerated true apiVersion policy v1

Answer:
---
api_metadata:
  apiVersion: "policy/v1"
  import: "k8s.io/api/policy/v1"
  kind: "PodDisruptionBudget"
content_type: "api_reference"
description: "PodDisruptionBudget is an object to define the max disruption that can be caused to a collection of pods."
title: "PodDisruptionBudget"
weight: 5
auto_generated: true
---

`apiVersion: policy/v1`

`import "k8s.io/api/policy/v1"`

## PodDisruptionBudget {#PodDisruptionBudget}

PodDisruptionBudget is an object to define the max disruption that can be caused to a collection of pods

- **apiVersion**: policy/v1

- **kind**: PodDisruptionBudget

- **metadata** (ObjectMeta)

  Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata

- **spec** (PodDisruptionBudgetSpec)

  Specification of the desired behavior of the PodDisruptionBudget.

- **status** (PodDisruptionBudgetStatus)

  Most recently observed status of the PodDisruptionBudget.

## PodDisruptionBudgetSpec {#PodDisruptionBudgetSpec}

PodDisruptionBudgetSpec is a description of a PodDisruptionBudget.

- **maxUnavailable** (IntOrString)

  An eviction is allowed if at most "maxUnavailable" pods selected by "selector" are unavailable after the eviction, i.e. even in absence of the evicted pod. For example, one can prevent all voluntary evictions by specifying 0. This is a mutually exclusive setting with "minAvailable".

  *IntOrString is a type that can hold an int32 or a string.  When used in JSON or YAML marshalling and unmarshalling, it produces or consumes the inner type.  This allows you to have, for example, a JSON field that can accept a name or number.*

- **minAvailable** (IntOrString)

  An eviction is allowed if at least "minAvailable" pods selected by "selector" will still be available after the eviction, i.e. even in the absence of the evicted pod.  So for example you can prevent all voluntary evictions by specifying "100%".

  *IntOrString is a type that can hold an int32 or a string.  When used in JSON or YAML marshalling and unmarshalling, it produces or consumes the inner type.  This allows you to have, for example, a JSON field that can accept a name or number.*

- **selector** (LabelSelector)

  Label query over pods whose evictions are managed by the disruption budget. A null selector will match no pods, while an empty ({}) selector will select all pods within the namespace.

- **unhealthyPodEvictionPolicy** (string)

  UnhealthyPodEvictionPolicy defines the criteria for when unhealthy pods should be considered for eviction. Current implementation considers healthy pods, as pods that have status.conditions item with type="Ready",status="True".

  Valid policies are IfHealthyBudget and AlwaysAllow. If no policy is specified, the default behavior will be used, which corresponds to the IfHealthyBudget policy.

  IfHealthyBudget policy means that running pods (status.phase="Running"), but not yet healthy can be evicted only if the guarded application is not disrupted (status.currentHealthy is at least equal to status.desiredHealthy). Healthy pods will be subject to the PDB for eviction.

  AlwaysAllow policy means that all running pods (status.phase="Running"), but not yet healthy are considered disrupted and can be evicted regardless of whether the criteria in a PDB is met. This means perspective running pods of a disrupted application might not get a chance to become healthy. Healthy pods will be subject to the PDB for eviction.

  Additional policies may be added in the future. Clients making eviction decisions should disallow eviction of unhealthy pods if they encounter an unrecognized policy in this field.

  This field is beta-level. The eviction API uses this field when the feature gate PDBUnhealthyPodEvictionPolicy is enabled (enabled by default).

## PodDisruptionBudgetStatus {#PodDisruptionBudgetStatus}

PodDisruptionBudgetStatus represents information about the status of a PodDisruptionBudget. Status may trail the actual state of a system.

- **currentHealthy** (int32), required

  current number of healthy pods

- **desiredHealthy** (int32), required

  minimum desired number of healthy pods

- **disruptionsAllowed** (int32), required

  Number of pod disruptions that are currently allowed.

- **expectedPods** (int32), required

  total number of pods counted by this disruption budget

- **conditions** ([]Condition)

  *Patch strategy: merge on key `type`*

  *Map: unique values on key type will be kept during a merge*

  Conditions contain conditions for PDB. The disruption controller sets the DisruptionAllowed condition. The following are known values for the reason field (additional reasons could be added in the future): - SyncFailed: The controller encountered an error and wasn't able to compute
                the number of allowed disruptions. Therefore no disruptions are
                allowed and the status of the condition will be False.
  - InsufficientPods: The number of pods are either at or below the number
                      required by the PodDisruptionBudget. No disruptions are
                      allowed and the status of the condition will be False.
  - SufficientPods: There are more pods than required by the PodDisruptionBudget.
                    The condition will be True, and the number of allowed
                    disruptions are provided by the disruptionsAllowed property.

  *Condition contains details for one aspect of the current state of this API Resource.*

  - **conditions.lastTransitionTime** (Time), required

    lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.

    *Time is a wrapper around time.Time which supports correct marshaling to YAML and JSON.  Wrappers are provided for many of the factory methods that the time package offers.*

  - **conditions.message** (string), required

    message is a human readable message indicating details about the transition. This may be an empty string.

  - **conditions.reason** (string), required

    reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.

  - **conditions.status** (string), required

    status of the condition, one of True, False, Unknown.

  - **conditions.type** (string), required

    type of condition in CamelCase or in foo.example.com/CamelCase.

  - **conditions.observedGeneration** (int64)

    observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.

- **disruptedPods** (map[string]Time)

  DisruptedPods contains information about pods whose eviction was processed by the API server eviction subresource handler but has not yet been observed by the PodDisruptionBudget controller. A pod will be in this map from the time when the API server processed the eviction request to the time when the pod is seen by PDB controller as having been marked for deletion (or after a timeout). The key in the map is the name of the pod and the value is the time when the API server processed the eviction request. If the deletion didn't occur and a pod is still there it will be removed from the list automatically by PodDisruptionBudget controller after some time. If everything goes smooth this map should be empty for the most of the time. Large number of entries in the map may indicate problems with pod deletions.

  *Time is a wrapper around time.Time which supports correct marshaling to YAML and JSON.  Wrappers are provided for many of the factory methods that the time package offers.*

- **observedGeneration** (int64)

  Most recent generation observed when updating this PDB status. DisruptionsAllowed and other status information is valid only if observedGeneration equals to PDB's object generation.

## PodDisruptionBudgetList {#PodDisruptionBudgetList}

PodDisruptionBudgetList is a collection of PodDisruptionBudgets.

- **apiVersion**: policy/v1

- **kind**: PodDisruptionBudgetList

- **metadata** (ListMeta)

  Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata

- **items** ([]PodDisruptionBudget), required

  Items is a list of PodDisruptionBudgets

## Operations {#Operations}

### `get` read the specified PodDisruptionBudget

#### HTTP Request

GET /apis/policy/v1/namespaces/{namespace}/poddisruptionbudgets/{name}

#### Parameters

- **name** (*in path*): string, required

  name of the PodDisruptionBudget

- **namespace** (*in path*): string, required

  namespace

- **pretty** (*in query*): string

  pretty

#### Response

200 (PodDisruptionBudget): OK

401: Unauthorized

### `get` read status of the specified PodDisruptionBudget

#### HTTP Request

GET /apis/policy/v1/namespaces/{namespace}/poddisruptionbudgets/{name}/status

#### Parameters

- **name** (*in path*): string, required

  name of the PodDisruptionBudget

- **namespace** (*in path*): string, required

  namespace

- **pretty** (*in query*): string

  pretty

#### Response

200 (PodDisruptionBudget): OK

401: Unauthorized

### `list` list or watch objects of kind PodDisruptionBudget

#### HTTP Request

GET /apis/policy/v1/namespaces/{namespace}/poddisruptionbudgets

#### Parameters

- **namespace** (*in path*): string, required

  namespace

- **allowWatchBookmarks** (*in query*): boolean

  allowWatchBookmarks

- **continue** (*in query*): string

  continue

- **fieldSelector** (*in query*): string

  fieldSelector

- **labelSelector** (*in query*): string

  labelSelector

- **limit** (*in query*): integer

  limit

- **pretty** (*in query*): string

  pretty

- **resourceVersion** (*in query*): string

  resourceVersion

- **resourceVersionMatch** (*in query*): string

  resourceVersionMatch

- **sendInitialEvents** (*in query*): boolean

  sendInitialEvents

- **timeoutSeconds** (*in query*): integer

  timeoutSeconds

- **watch** (*in query*): boolean

  watch

#### Response

200 (PodDisruptionBudgetList): OK

401: Unauthorized

### `list` list or watch objects of kind PodDisruptionBudget

#### HTTP Request

GET /apis/policy/v1/poddisruptionbudgets

#### Parameters

- **allowWatchBookmarks** (*in query*): boolean

  allowWatchBookmarks

- **continue** (*in query*): string

  continue

- **fieldSelector** (*in query*): string

  fieldSelector

- **labelSelector** (*in query*): string

  labelSelector

- **limit** (*in query*): integer

  limit

- **pretty** (*in query*): string

  pretty

- **resourceVersion** (*in query*): string

  resourceVersion

- **resourceVersionMatch** (*in query*): string

  resourceVersionMatch

- **sendInitialEvents** (*in query*): boolean

  sendInitialEvents

- **timeoutSeconds** (*in query*): integer

  timeoutSeconds

- **watch** (*in query*): boolean

  watch

#### Response

200 (PodDisruptionBudgetList): OK

401: Unauthorized

### `create` create a PodDisruptionBudget

#### HTTP Request

POST /apis/policy/v1/namespaces/{namespace}/poddisruptionbudgets

#### Parameters

- **namespace** (*in path*): string, required

  namespace

- **body**: PodDisruptionBudget, required

- **dryRun** (*in query*): string

  dryRun

- **fieldManager** (*in query*): string

  fieldManager

- **fieldValidation** (*in query*): string

  fieldValidation

- **pretty** (*in query*): string

  pretty

#### Response

200 (PodDisruptionBudget): OK

201 (PodDisruptionBudget): Created

202 (PodDisruptionBudget): Accepted

401: Unauthorized

### `update` replace the specified PodDisruptionBudget

#### HTTP Request

PUT /apis/policy/v1/namespaces/{namespace}/poddisruptionbudgets/{name}

#### Parameters

- **name** (*in path*): string, required

  name of the PodDisruptionBudget

- **namespace** (*in path*): string, required

  namespace

- **body**: PodDisruptionBudget, required

- **dryRun** (*in query*): string

  dryRun

- **fieldManager** (*in query*): string

  fieldManager

- **fieldValidation** (*in query*): string

  fieldValidation

- **pretty** (*in query*): string

  pretty

#### Response

200 (PodDisruptionBudget): OK

201 (PodDisruptionBudget): Created

401: Unauthorized

### `update` replace status of the specified PodDisruptionBudget

#### HTTP Request

PUT /apis/policy/v1/namespaces/{namespace}/poddisruptionbudgets/{name}/status

#### Parameters

- **name** (*in path*): string, required

  name of the PodDisruptionBudget

- **namespace** (*in path*): string, required

  namespace

- **body**: PodDisruptionBudget, required

- **dryRun** (*in query*): string

  dryRun

- **fieldManager** (*in query*): string

  fieldManager

- **fieldValidation** (*in query*): string

  fieldValidation

- **pretty** (*in query*): string

  pretty

#### Response

200 (PodDisruptionBudget): OK

201 (PodDisruptionBudget): Created

401: Unauthorized

### `patch` partially update the specified PodDisruptionBudget

#### HTTP Request

PATCH /apis/policy/v1/namespaces/{namespace}/poddisruptionbudgets/{name}

#### Parameters

- **name** (*in path*): string, required

  name of the PodDisruptionBudget

- **namespace** (*in path*): string, required

  namespace

- **body**: Patch, required

- **dryRun** (*in query*): string

  dryRun

- **fieldManager** (*in query*): string

  fieldManager

- **fieldValidation** (*in query*): string

  fieldValidation

- **force** (*in query*): boolean

  force

- **pretty** (*in query*): string

  pretty

#### Response

200 (PodDisruptionBudget): OK

201 (PodDisruptionBudget): Created

401: Unauthorized

### `patch` partially update status of the specified PodDisruptionBudget

#### HTTP Request

PATCH /apis/policy/v1/namespaces/{namespace}/poddisruptionbudgets/{name}/status

#### Parameters

- **name** (*in path*): string, required

  name of the PodDisruptionBudget

- **namespace** (*in path*): string, required

  namespace

- **body**: Patch, required

- **dryRun** (*in query*): string

  dryRun

- **fieldManager** (*in query*): string

  fieldManager

- **fieldValidation** (*in query*): string

  fieldValidation

- **force** (*in query*): boolean

  force

- **pretty** (*in query*): string

  pretty

#### Response

200 (PodDisruptionBudget): OK

201 (PodDisruptionBudget): Created

401: Unauthorized

### `delete` delete a PodDisruptionBudget

#### HTTP Request

DELETE /apis/policy/v1/namespaces/{namespace}/poddisruptionbudgets/{name}

#### Parameters

- **name** (*in path*): string, required

  name of the PodDisruptionBudget

- **namespace** (*in path*): string, required

  namespace

- **body**: DeleteOptions

- **dryRun** (*in query*): string

  dryRun

- **gracePeriodSeconds** (*in query*): integer

  gracePeriodSeconds

- **pretty** (*in query*): string

  pretty

- **propagationPolicy** (*in query*): string

  propagationPolicy

#### Response

200 (Status): OK

202 (Status): Accepted

401: Unauthorized

### `deletecollection` delete collection of PodDisruptionBudget

#### HTTP Request

DELETE /apis/policy/v1/namespaces/{namespace}/poddisruptionbudgets

#### Parameters

- **namespace** (*in path*): string, required

  namespace

- **body**: DeleteOptions

- **continue** (*in query*): string

  continue

- **dryRun** (*in query*): string

  dryRun

- **fieldSelector** (*in query*): string

  fieldSelector

- **gracePeriodSeconds** (*in query*): integer

  gracePeriodSeconds

- **labelSelector** (*in query*): string

  labelSelector

- **limit** (*in query*): integer

  limit

- **pretty** (*in query*): string

  pretty

- **propagationPolicy** (*in query*): string

  propagationPolicy

- **resourceVersion** (*in query*): string

  resourceVersion

- **resourceVersionMatch** (*in query*): string

  resourceVersionMatch

- **sendInitialEvents** (*in query*): boolean

  sendInitialEvents

- **timeoutSeconds** (*in query*): integer

  timeoutSeconds

#### Response

200 (Status): OK

401: Unauthorized

api metadata    apiVersion   policy v1    import   k8s io api policy v1    kind   PodDisruptionBudget  content type   api reference  description   PodDisruptionBudget is an object to define the max disruption that can be caused to a collection of pods   title   PodDisruptionBudget  weight  5 auto generated  true           The file is auto generated from the Go source code of the component using a generic  generator  https   github com kubernetes sigs reference docs    To learn how to generate the reference documentation  please read  Contributing to the reference documentation   docs contribute generate ref docs    To update the reference content  please follow the   Contributing upstream   docs contribute generate ref docs contribute upstream   guide  You can file document formatting bugs against the  reference docs  https   github com kubernetes sigs reference docs   project        apiVersion  policy v1    import  k8s io api policy v1        PodDisruptionBudget   PodDisruptionBudget   PodDisruptionBudget is an object to define the max disruption that can be caused to a collection of pods   hr       apiVersion    policy v1       kind    PodDisruptionBudget       metadata     a href    ObjectMeta  a      Standard object s metadata  More info  https   git k8s io community contributors devel sig architecture api conventions md metadata      spec     a href    PodDisruptionBudgetSpec  a      Specification of the desired behavior of the PodDisruptionBudget       status     a href    PodDisruptionBudgetStatus  a      Most recently observed status of the PodDisruptionBudget          PodDisruptionBudgetSpec   PodDisruptionBudgetSpec   PodDisruptionBudgetSpec is a description of a PodDisruptionBudget    hr       maxUnavailable    IntOrString     An eviction is allowed if at most  maxUnavailable  pods selected by  selector  are unavailable after the eviction  i e  even in absence of the evicted pod  For example  one can prevent all voluntary evictions by specifying 0  This is a mutually exclusive setting with  minAvailable       a name  IntOrString    a     IntOrString is a type that can hold an int32 or a string   When used in JSON or YAML marshalling and unmarshalling  it produces or consumes the inner type   This allows you to have  for example  a JSON field that can accept a name or number        minAvailable    IntOrString     An eviction is allowed if at least  minAvailable  pods selected by  selector  will still be available after the eviction  i e  even in the absence of the evicted pod   So for example you can prevent all voluntary evictions by specifying  100        a name  IntOrString    a     IntOrString is a type that can hold an int32 or a string   When used in JSON or YAML marshalling and unmarshalling  it produces or consumes the inner type   This allows you to have  for example  a JSON field that can accept a name or number        selector     a href    LabelSelector  a      Label query over pods whose evictions are managed by the disruption budget  A null selector will match no pods  while an empty      selector will select all pods within the namespace       unhealthyPodEvictionPolicy    string     UnhealthyPodEvictionPolicy defines the criteria for when unhealthy pods should be considered for eviction  Current implementation considers healthy pods  as pods that have status conditions item with type  Ready  status  True        Valid policies are IfHealthyBudget and AlwaysAllow  If no policy is specified  the default behavior will be used  which corresponds to the IfHealthyBudget policy       IfHealthyBudget policy means that running pods  status phase  Running    but not yet healthy can be evicted only if the guarded application is not disrupted  status currentHealthy is at least equal to status desiredHealthy   Healthy pods will be subject to the PDB for eviction       AlwaysAllow policy means that all running pods  status phase  Running    but not yet healthy are considered disrupted and can be evicted regardless of whether the criteria in a PDB is met  This means perspective running pods of a disrupted application might not get a chance to become healthy  Healthy pods will be subject to the PDB for eviction       Additional policies may be added in the future  Clients making eviction decisions should disallow eviction of unhealthy pods if they encounter an unrecognized policy in this field       This field is beta level  The eviction API uses this field when the feature gate PDBUnhealthyPodEvictionPolicy is enabled  enabled by default           PodDisruptionBudgetStatus   PodDisruptionBudgetStatus   PodDisruptionBudgetStatus represents information about the status of a PodDisruptionBudget  Status may trail the actual state of a system    hr       currentHealthy    int32   required    current number of healthy pods      desiredHealthy    int32   required    minimum desired number of healthy pods      disruptionsAllowed    int32   required    Number of pod disruptions that are currently allowed       expectedPods    int32   required    total number of pods counted by this disruption budget      conditions      Condition      Patch strategy  merge on key  type         Map  unique values on key type will be kept during a merge       Conditions contain conditions for PDB  The disruption controller sets the DisruptionAllowed condition  The following are known values for the reason field  additional reasons could be added in the future     SyncFailed  The controller encountered an error and wasn t able to compute                 the number of allowed disruptions  Therefore no disruptions are                 allowed and the status of the condition will be False      InsufficientPods  The number of pods are either at or below the number                       required by the PodDisruptionBudget  No disruptions are                       allowed and the status of the condition will be False      SufficientPods  There are more pods than required by the PodDisruptionBudget                      The condition will be True  and the number of allowed                     disruptions are provided by the disruptionsAllowed property      a name  Condition    a     Condition contains details for one aspect of the current state of this API Resource          conditions lastTransitionTime    Time   required      lastTransitionTime is the last time the condition transitioned from one status to another  This should be when the underlying condition changed   If that is not known  then using the time when the API field changed is acceptable        a name  Time    a       Time is a wrapper around time Time which supports correct marshaling to YAML and JSON   Wrappers are provided for many of the factory methods that the time package offers          conditions message    string   required      message is a human readable message indicating details about the transition  This may be an empty string         conditions reason    string   required      reason contains a programmatic identifier indicating the reason for the condition s last transition  Producers of specific condition types may define expected values and meanings for this field  and whether the values are considered a guaranteed API  The value should be a CamelCase string  This field may not be empty         conditions status    string   required      status of the condition  one of True  False  Unknown         conditions type    string   required      type of condition in CamelCase or in foo example com CamelCase         conditions observedGeneration    int64       observedGeneration represents the  metadata generation that the condition was set based upon  For instance  if  metadata generation is currently 12  but the  status conditions x  observedGeneration is 9  the condition is out of date with respect to the current state of the instance       disruptedPods    map string Time     DisruptedPods contains information about pods whose eviction was processed by the API server eviction subresource handler but has not yet been observed by the PodDisruptionBudget controller  A pod will be in this map from the time when the API server processed the eviction request to the time when the pod is seen by PDB controller as having been marked for deletion  or after a timeout   The key in the map is the name of the pod and the value is the time when the API server processed the eviction request  If the deletion didn t occur and a pod is still there it will be removed from the list automatically by PodDisruptionBudget controller after some time  If everything goes smooth this map should be empty for the most of the time  Large number of entries in the map may indicate problems with pod deletions      a name  Time    a     Time is a wrapper around time Time which supports correct marshaling to YAML and JSON   Wrappers are provided for many of the factory methods that the time package offers        observedGeneration    int64     Most recent generation observed when updating this PDB status  DisruptionsAllowed and other status information is valid only if observedGeneration equals to PDB s object generation          PodDisruptionBudgetList   PodDisruptionBudgetList   PodDisruptionBudgetList is a collection of PodDisruptionBudgets    hr       apiVersion    policy v1       kind    PodDisruptionBudgetList       metadata     a href    ListMeta  a      Standard object s metadata  More info  https   git k8s io community contributors devel sig architecture api conventions md metadata      items       a href    PodDisruptionBudget  a    required    Items is a list of PodDisruptionBudgets         Operations   Operations      hr             get  read the specified PodDisruptionBudget       HTTP Request  GET  apis policy v1 namespaces  namespace  poddisruptionbudgets  name        Parameters       name     in path    string  required    name of the PodDisruptionBudget       namespace     in path    string  required     a href    namespace  a        pretty     in query    string     a href    pretty  a          Response   200   a href    PodDisruptionBudget  a    OK  401  Unauthorized        get  read status of the specified PodDisruptionBudget       HTTP Request  GET  apis policy v1 namespaces  namespace  poddisruptionbudgets  name  status       Parameters       name     in path    string  required    name of the PodDisruptionBudget       namespace     in path    string  required     a href    namespace  a        pretty     in query    string     a href    pretty  a          Response   200   a href    PodDisruptionBudget  a    OK  401  Unauthorized        list  list or watch objects of kind PodDisruptionBudget       HTTP Request  GET  apis policy v1 namespaces  namespace  poddisruptionbudgets       Parameters       namespace     in path    string  required     a href    namespace  a        allowWatchBookmarks     in query    boolean     a href    allowWatchBookmarks  a        continue     in query    string     a href    continue  a        fieldSelector     in query    string     a href    fieldSelector  a        labelSelector     in query    string     a href    labelSelector  a        limit     in query    integer     a href    limit  a        pretty     in query    string     a href    pretty  a        resourceVersion     in query    string     a href    resourceVersion  a        resourceVersionMatch     in query    string     a href    resourceVersionMatch  a        sendInitialEvents     in query    boolean     a href    sendInitialEvents  a        timeoutSeconds     in query    integer     a href    timeoutSeconds  a        watch     in query    boolean     a href    watch  a          Response   200   a href    PodDisruptionBudgetList  a    OK  401  Unauthorized        list  list or watch objects of kind PodDisruptionBudget       HTTP Request  GET  apis policy v1 poddisruptionbudgets       Parameters       allowWatchBookmarks     in query    boolean     a href    allowWatchBookmarks  a        continue     in query    string     a href    continue  a        fieldSelector     in query    string     a href    fieldSelector  a        labelSelector     in query    string     a href    labelSelector  a        limit     in query    integer     a href    limit  a        pretty     in query    string     a href    pretty  a        resourceVersion     in query    string     a href    resourceVersion  a        resourceVersionMatch     in query    string     a href    resourceVersionMatch  a        sendInitialEvents     in query    boolean     a href    sendInitialEvents  a        timeoutSeconds     in query    integer     a href    timeoutSeconds  a        watch     in query    boolean     a href    watch  a          Response   200   a href    PodDisruptionBudgetList  a    OK  401  Unauthorized        create  create a PodDisruptionBudget       HTTP Request  POST  apis policy v1 namespaces  namespace  poddisruptionbudgets       Parameters       namespace     in path    string  required     a href    namespace  a        body     a href    PodDisruptionBudget  a   required           dryRun     in query    string     a href    dryRun  a        fieldManager     in query    string     a href    fieldManager  a        fieldValidation     in query    string     a href    fieldValidation  a        pretty     in query    string     a href    pretty  a          Response   200   a href    PodDisruptionBudget  a    OK  201   a href    PodDisruptionBudget  a    Created  202   a href    PodDisruptionBudget  a    Accepted  401  Unauthorized        update  replace the specified PodDisruptionBudget       HTTP Request  PUT  apis policy v1 namespaces  namespace  poddisruptionbudgets  name        Parameters       name     in path    string  required    name of the PodDisruptionBudget       namespace     in path    string  required     a href    namespace  a        body     a href    PodDisruptionBudget  a   required           dryRun     in query    string     a href    dryRun  a        fieldManager     in query    string     a href    fieldManager  a        fieldValidation     in query    string     a href    fieldValidation  a        pretty     in query    string     a href    pretty  a          Response   200   a href    PodDisruptionBudget  a    OK  201   a href    PodDisruptionBudget  a    Created  401  Unauthorized        update  replace status of the specified PodDisruptionBudget       HTTP Request  PUT  apis policy v1 namespaces  namespace  poddisruptionbudgets  name  status       Parameters       name     in path    string  required    name of the PodDisruptionBudget       namespace     in path    string  required     a href    namespace  a        body     a href    PodDisruptionBudget  a   required           dryRun     in query    string     a href    dryRun  a        fieldManager     in query    string     a href    fieldManager  a        fieldValidation     in query    string     a href    fieldValidation  a        pretty     in query    string     a href    pretty  a          Response   200   a href    PodDisruptionBudget  a    OK  201   a href    PodDisruptionBudget  a    Created  401  Unauthorized        patch  partially update the specified PodDisruptionBudget       HTTP Request  PATCH  apis policy v1 namespaces  namespace  poddisruptionbudgets  name        Parameters       name     in path    string  required    name of the PodDisruptionBudget       namespace     in path    string  required     a href    namespace  a        body     a href    Patch  a   required           dryRun     in query    string     a href    dryRun  a        fieldManager     in query    string     a href    fieldManager  a        fieldValidation     in query    string     a href    fieldValidation  a        force     in query    boolean     a href    force  a        pretty     in query    string     a href    pretty  a          Response   200   a href    PodDisruptionBudget  a    OK  201   a href    PodDisruptionBudget  a    Created  401  Unauthorized        patch  partially update status of the specified PodDisruptionBudget       HTTP Request  PATCH  apis policy v1 namespaces  namespace  poddisruptionbudgets  name  status       Parameters       name     in path    string  required    name of the PodDisruptionBudget       namespace     in path    string  required     a href    namespace  a        body     a href    Patch  a   required           dryRun     in query    string     a href    dryRun  a        fieldManager     in query    string     a href    fieldManager  a        fieldValidation     in query    string     a href    fieldValidation  a        force     in query    boolean     a href    force  a        pretty     in query    string     a href    pretty  a          Response   200   a href    PodDisruptionBudget  a    OK  201   a href    PodDisruptionBudget  a    Created  401  Unauthorized        delete  delete a PodDisruptionBudget       HTTP Request  DELETE  apis policy v1 namespaces  namespace  poddisruptionbudgets  name        Parameters       name     in path    string  required    name of the PodDisruptionBudget       namespace     in path    string  required     a href    namespace  a        body     a href    DeleteOptions  a            dryRun     in query    string     a href    dryRun  a        gracePeriodSeconds     in query    integer     a href    gracePeriodSeconds  a        pretty     in query    string     a href    pretty  a        propagationPolicy     in query    string     a href    propagationPolicy  a          Response   200   a href    Status  a    OK  202   a href    Status  a    Accepted  401  Unauthorized        deletecollection  delete collection of PodDisruptionBudget       HTTP Request  DELETE  apis policy v1 namespaces  namespace  poddisruptionbudgets       Parameters       namespace     in path    string  required     a href    namespace  a        body     a href    DeleteOptions  a            continue     in query    string     a href    continue  a        dryRun     in query    string     a href    dryRun  a        fieldSelector     in query    string     a href    fieldSelector  a        gracePeriodSeconds     in query    integer     a href    gracePeriodSeconds  a        labelSelector     in query    string     a href    labelSelector  a        limit     in query    integer     a href    limit  a        pretty     in query    string     a href    pretty  a        propagationPolicy     in query    string     a href    propagationPolicy  a        resourceVersion     in query    string     a href    resourceVersion  a        resourceVersionMatch     in query    string     a href    resourceVersionMatch  a        sendInitialEvents     in query    boolean     a href    sendInitialEvents  a        timeoutSeconds     in query    integer     a href    timeoutSeconds  a          Response   200   a href    Status  a    OK  401  Unauthorized


kubernetes reference import k8s io api flowcontrol v1 apiVersion flowcontrol apiserver k8s io v1 contenttype apireference title FlowSchema apimetadata FlowSchema defines the schema of a group of flows autogenerated true weight 1 kind FlowSchema

Answer:
---
api_metadata:
  apiVersion: "flowcontrol.apiserver.k8s.io/v1"
  import: "k8s.io/api/flowcontrol/v1"
  kind: "FlowSchema"
content_type: "api_reference"
description: "FlowSchema defines the schema of a group of flows."
title: "FlowSchema"
weight: 1
auto_generated: true
---

`apiVersion: flowcontrol.apiserver.k8s.io/v1`

`import "k8s.io/api/flowcontrol/v1"`

## FlowSchema {#FlowSchema}

FlowSchema defines the schema of a group of flows. Note that a flow is made up of a set of inbound API requests with similar attributes and is identified by a pair of strings: the name of the FlowSchema and a "flow distinguisher".

- **apiVersion**: flowcontrol.apiserver.k8s.io/v1

- **kind**: FlowSchema

- **metadata** (ObjectMeta)

  `metadata` is the standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata

- **spec** (FlowSchemaSpec)

  `spec` is the specification of the desired behavior of a FlowSchema. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status

- **status** (FlowSchemaStatus)

  `status` is the current status of a FlowSchema. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status

## FlowSchemaSpec {#FlowSchemaSpec}

FlowSchemaSpec describes how the FlowSchema's specification looks like.

- **distinguisherMethod** (FlowDistinguisherMethod)

  `distinguisherMethod` defines how to compute the flow distinguisher for requests that match this schema. `nil` specifies that the distinguisher is disabled and thus will always be the empty string.

  *FlowDistinguisherMethod specifies the method of a flow distinguisher.*

  - **distinguisherMethod.type** (string), required

    `type` is the type of flow distinguisher method The supported types are "ByUser" and "ByNamespace". Required.

- **matchingPrecedence** (int32)

  `matchingPrecedence` is used to choose among the FlowSchemas that match a given request. The chosen FlowSchema is among those with the numerically lowest (which we take to be logically highest) MatchingPrecedence.  Each MatchingPrecedence value must be ranged in [1,10000]. Note that if the precedence is not specified, it will be set to 1000 as default.

- **priorityLevelConfiguration** (PriorityLevelConfigurationReference), required

  `priorityLevelConfiguration` should reference a PriorityLevelConfiguration in the cluster. If the reference cannot be resolved, the FlowSchema will be ignored and marked as invalid in its status. Required.

  *PriorityLevelConfigurationReference contains information that points to the "request-priority" being used.*

  - **priorityLevelConfiguration.name** (string), required

    `name` is the name of the priority level configuration being referenced Required.

- **rules** ([]PolicyRulesWithSubjects)

  *Atomic: will be replaced during a merge*

  `rules` describes which requests will match this flow schema. This FlowSchema matches a request if and only if at least one member of rules matches the request. if it is an empty slice, there will be no requests matching the FlowSchema.

  *PolicyRulesWithSubjects prescribes a test that applies to a request to an apiserver. The test considers the subject making the request, the verb being requested, and the resource to be acted upon. This PolicyRulesWithSubjects matches a request if and only if both (a) at least one member of subjects matches the request and (b) at least one member of resourceRules or nonResourceRules matches the request.*

  - **rules.subjects** ([]Subject), required

    *Atomic: will be replaced during a merge*

    subjects is the list of normal user, serviceaccount, or group that this rule cares about. There must be at least one member in this slice. A slice that includes both the system:authenticated and system:unauthenticated user groups matches every request. Required.

    *Subject matches the originator of a request, as identified by the request authentication system. There are three ways of matching an originator; by user, group, or service account.*

    - **rules.subjects.kind** (string), required

      `kind` indicates which one of the other fields is non-empty. Required

    - **rules.subjects.group** (GroupSubject)

      `group` matches based on user group name.

      *GroupSubject holds detailed information for group-kind subject.*

      - **rules.subjects.group.name** (string), required

        name is the user group that matches, or "*" to match all user groups. See https://github.com/kubernetes/apiserver/blob/master/pkg/authentication/user/user.go for some well-known group names. Required.

    - **rules.subjects.serviceAccount** (ServiceAccountSubject)

      `serviceAccount` matches ServiceAccounts.

      *ServiceAccountSubject holds detailed information for service-account-kind subject.*

      - **rules.subjects.serviceAccount.name** (string), required

        `name` is the name of matching ServiceAccount objects, or "*" to match regardless of name. Required.

      - **rules.subjects.serviceAccount.namespace** (string), required

        `namespace` is the namespace of matching ServiceAccount objects. Required.

    - **rules.subjects.user** (UserSubject)

      `user` matches based on username.

      *UserSubject holds detailed information for user-kind subject.*

      - **rules.subjects.user.name** (string), required

        `name` is the username that matches, or "*" to match all usernames. Required.

  - **rules.nonResourceRules** ([]NonResourcePolicyRule)

    *Atomic: will be replaced during a merge*

    `nonResourceRules` is a list of NonResourcePolicyRules that identify matching requests according to their verb and the target non-resource URL.

    *NonResourcePolicyRule is a predicate that matches non-resource requests according to their verb and the target non-resource URL. A NonResourcePolicyRule matches a request if and only if both (a) at least one member of verbs matches the request and (b) at least one member of nonResourceURLs matches the request.*

    - **rules.nonResourceRules.nonResourceURLs** ([]string), required

      *Set: unique values will be kept during a merge*

      `nonResourceURLs` is a set of url prefixes that a user should have access to and may not be empty. For example:
        - "/healthz" is legal
        - "/hea*" is illegal
        - "/hea" is legal but matches nothing
        - "/hea/*" also matches nothing
        - "/healthz/*" matches all per-component health checks.
      "*" matches all non-resource urls. if it is present, it must be the only entry. Required.

    - **rules.nonResourceRules.verbs** ([]string), required

      *Set: unique values will be kept during a merge*

      `verbs` is a list of matching verbs and may not be empty. "*" matches all verbs. If it is present, it must be the only entry. Required.

  - **rules.resourceRules** ([]ResourcePolicyRule)

    *Atomic: will be replaced during a merge*

    `resourceRules` is a slice of ResourcePolicyRules that identify matching requests according to their verb and the target resource. At least one of `resourceRules` and `nonResourceRules` has to be non-empty.

    *ResourcePolicyRule is a predicate that matches some resource requests, testing the request's verb and the target resource. A ResourcePolicyRule matches a resource request if and only if: (a) at least one member of verbs matches the request, (b) at least one member of apiGroups matches the request, (c) at least one member of resources matches the request, and (d) either (d1) the request does not specify a namespace (i.e., `Namespace==""`) and clusterScope is true or (d2) the request specifies a namespace and least one member of namespaces matches the request's namespace.*

    - **rules.resourceRules.apiGroups** ([]string), required

      *Set: unique values will be kept during a merge*

      `apiGroups` is a list of matching API groups and may not be empty. "*" matches all API groups and, if present, must be the only entry. Required.

    - **rules.resourceRules.resources** ([]string), required

      *Set: unique values will be kept during a merge*

      `resources` is a list of matching resources (i.e., lowercase and plural) with, if desired, subresource.  For example, [ "services", "nodes/status" ].  This list may not be empty. "*" matches all resources and, if present, must be the only entry. Required.

    - **rules.resourceRules.verbs** ([]string), required

      *Set: unique values will be kept during a merge*

      `verbs` is a list of matching verbs and may not be empty. "*" matches all verbs and, if present, must be the only entry. Required.

    - **rules.resourceRules.clusterScope** (boolean)

      `clusterScope` indicates whether to match requests that do not specify a namespace (which happens either because the resource is not namespaced or the request targets all namespaces). If this field is omitted or false then the `namespaces` field must contain a non-empty list.

    - **rules.resourceRules.namespaces** ([]string)

      *Set: unique values will be kept during a merge*

      `namespaces` is a list of target namespaces that restricts matches.  A request that specifies a target namespace matches only if either (a) this list contains that target namespace or (b) this list contains "*".  Note that "*" matches any specified namespace but does not match a request that _does not specify_ a namespace (see the `clusterScope` field for that). This list may be empty, but only if `clusterScope` is true.

## FlowSchemaStatus {#FlowSchemaStatus}

FlowSchemaStatus represents the current state of a FlowSchema.

- **conditions** ([]FlowSchemaCondition)

  *Patch strategy: merge on key `type`*

  *Map: unique values on key type will be kept during a merge*

  `conditions` is a list of the current states of FlowSchema.

  *FlowSchemaCondition describes conditions for a FlowSchema.*

  - **conditions.lastTransitionTime** (Time)

    `lastTransitionTime` is the last time the condition transitioned from one status to another.

    *Time is a wrapper around time.Time which supports correct marshaling to YAML and JSON.  Wrappers are provided for many of the factory methods that the time package offers.*

  - **conditions.message** (string)

    `message` is a human-readable message indicating details about last transition.

  - **conditions.reason** (string)

    `reason` is a unique, one-word, CamelCase reason for the condition's last transition.

  - **conditions.status** (string)

    `status` is the status of the condition. Can be True, False, Unknown. Required.

  - **conditions.type** (string)

    `type` is the type of the condition. Required.

## FlowSchemaList {#FlowSchemaList}

FlowSchemaList is a list of FlowSchema objects.

- **apiVersion**: flowcontrol.apiserver.k8s.io/v1

- **kind**: FlowSchemaList

- **metadata** (ListMeta)

  `metadata` is the standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata

- **items** ([]FlowSchema), required

  `items` is a list of FlowSchemas.

## Operations {#Operations}

### `get` read the specified FlowSchema

#### HTTP Request

GET /apis/flowcontrol.apiserver.k8s.io/v1/flowschemas/{name}

#### Parameters

- **name** (*in path*): string, required

  name of the FlowSchema

- **pretty** (*in query*): string

  pretty

#### Response

200 (FlowSchema): OK

401: Unauthorized

### `get` read status of the specified FlowSchema

#### HTTP Request

GET /apis/flowcontrol.apiserver.k8s.io/v1/flowschemas/{name}/status

#### Parameters

- **name** (*in path*): string, required

  name of the FlowSchema

- **pretty** (*in query*): string

  pretty

#### Response

200 (FlowSchema): OK

401: Unauthorized

### `list` list or watch objects of kind FlowSchema

#### HTTP Request

GET /apis/flowcontrol.apiserver.k8s.io/v1/flowschemas

#### Parameters

- **allowWatchBookmarks** (*in query*): boolean

  allowWatchBookmarks

- **continue** (*in query*): string

  continue

- **fieldSelector** (*in query*): string

  fieldSelector

- **labelSelector** (*in query*): string

  labelSelector

- **limit** (*in query*): integer

  limit

- **pretty** (*in query*): string

  pretty

- **resourceVersion** (*in query*): string

  resourceVersion

- **resourceVersionMatch** (*in query*): string

  resourceVersionMatch

- **sendInitialEvents** (*in query*): boolean

  sendInitialEvents

- **timeoutSeconds** (*in query*): integer

  timeoutSeconds

- **watch** (*in query*): boolean

  watch

#### Response

200 (FlowSchemaList): OK

401: Unauthorized

### `create` create a FlowSchema

#### HTTP Request

POST /apis/flowcontrol.apiserver.k8s.io/v1/flowschemas

#### Parameters

- **body**: FlowSchema, required

- **dryRun** (*in query*): string

  dryRun

- **fieldManager** (*in query*): string

  fieldManager

- **fieldValidation** (*in query*): string

  fieldValidation

- **pretty** (*in query*): string

  pretty

#### Response

200 (FlowSchema): OK

201 (FlowSchema): Created

202 (FlowSchema): Accepted

401: Unauthorized

### `update` replace the specified FlowSchema

#### HTTP Request

PUT /apis/flowcontrol.apiserver.k8s.io/v1/flowschemas/{name}

#### Parameters

- **name** (*in path*): string, required

  name of the FlowSchema

- **body**: FlowSchema, required

- **dryRun** (*in query*): string

  dryRun

- **fieldManager** (*in query*): string

  fieldManager

- **fieldValidation** (*in query*): string

  fieldValidation

- **pretty** (*in query*): string

  pretty

#### Response

200 (FlowSchema): OK

201 (FlowSchema): Created

401: Unauthorized

### `update` replace status of the specified FlowSchema

#### HTTP Request

PUT /apis/flowcontrol.apiserver.k8s.io/v1/flowschemas/{name}/status

#### Parameters

- **name** (*in path*): string, required

  name of the FlowSchema

- **body**: FlowSchema, required

- **dryRun** (*in query*): string

  dryRun

- **fieldManager** (*in query*): string

  fieldManager

- **fieldValidation** (*in query*): string

  fieldValidation

- **pretty** (*in query*): string

  pretty

#### Response

200 (FlowSchema): OK

201 (FlowSchema): Created

401: Unauthorized

### `patch` partially update the specified FlowSchema

#### HTTP Request

PATCH /apis/flowcontrol.apiserver.k8s.io/v1/flowschemas/{name}

#### Parameters

- **name** (*in path*): string, required

  name of the FlowSchema

- **body**: Patch, required

- **dryRun** (*in query*): string

  dryRun

- **fieldManager** (*in query*): string

  fieldManager

- **fieldValidation** (*in query*): string

  fieldValidation

- **force** (*in query*): boolean

  force

- **pretty** (*in query*): string

  pretty

#### Response

200 (FlowSchema): OK

201 (FlowSchema): Created

401: Unauthorized

### `patch` partially update status of the specified FlowSchema

#### HTTP Request

PATCH /apis/flowcontrol.apiserver.k8s.io/v1/flowschemas/{name}/status

#### Parameters

- **name** (*in path*): string, required

  name of the FlowSchema

- **body**: Patch, required

- **dryRun** (*in query*): string

  dryRun

- **fieldManager** (*in query*): string

  fieldManager

- **fieldValidation** (*in query*): string

  fieldValidation

- **force** (*in query*): boolean

  force

- **pretty** (*in query*): string

  pretty

#### Response

200 (FlowSchema): OK

201 (FlowSchema): Created

401: Unauthorized

### `delete` delete a FlowSchema

#### HTTP Request

DELETE /apis/flowcontrol.apiserver.k8s.io/v1/flowschemas/{name}

#### Parameters

- **name** (*in path*): string, required

  name of the FlowSchema

- **body**: DeleteOptions

- **dryRun** (*in query*): string

  dryRun

- **gracePeriodSeconds** (*in query*): integer

  gracePeriodSeconds

- **pretty** (*in query*): string

  pretty

- **propagationPolicy** (*in query*): string

  propagationPolicy

#### Response

200 (Status): OK

202 (Status): Accepted

401: Unauthorized

### `deletecollection` delete collection of FlowSchema

#### HTTP Request

DELETE /apis/flowcontrol.apiserver.k8s.io/v1/flowschemas

#### Parameters

- **body**: DeleteOptions

- **continue** (*in query*): string

  continue

- **dryRun** (*in query*): string

  dryRun

- **fieldSelector** (*in query*): string

  fieldSelector

- **gracePeriodSeconds** (*in query*): integer

  gracePeriodSeconds

- **labelSelector** (*in query*): string

  labelSelector

- **limit** (*in query*): integer

  limit

- **pretty** (*in query*): string

  pretty

- **propagationPolicy** (*in query*): string

  propagationPolicy

- **resourceVersion** (*in query*): string

  resourceVersion

- **resourceVersionMatch** (*in query*): string

  resourceVersionMatch

- **sendInitialEvents** (*in query*): boolean

  sendInitialEvents

- **timeoutSeconds** (*in query*): integer

  timeoutSeconds

#### Response

200 (Status): OK

401: Unauthorized

api metadata    apiVersion   flowcontrol apiserver k8s io v1    import   k8s io api flowcontrol v1    kind   FlowSchema  content type   api reference  description   FlowSchema defines the schema of a group of flows   title   FlowSchema  weight  1 auto generated  true           The file is auto generated from the Go source code of the component using a generic  generator  https   github com kubernetes sigs reference docs    To learn how to generate the reference documentation  please read  Contributing to the reference documentation   docs contribute generate ref docs    To update the reference content  please follow the   Contributing upstream   docs contribute generate ref docs contribute upstream   guide  You can file document formatting bugs against the  reference docs  https   github com kubernetes sigs reference docs   project        apiVersion  flowcontrol apiserver k8s io v1    import  k8s io api flowcontrol v1        FlowSchema   FlowSchema   FlowSchema defines the schema of a group of flows  Note that a flow is made up of a set of inbound API requests with similar attributes and is identified by a pair of strings  the name of the FlowSchema and a  flow distinguisher     hr       apiVersion    flowcontrol apiserver k8s io v1       kind    FlowSchema       metadata     a href    ObjectMeta  a       metadata  is the standard object s metadata  More info  https   git k8s io community contributors devel sig architecture api conventions md metadata      spec     a href    FlowSchemaSpec  a       spec  is the specification of the desired behavior of a FlowSchema  More info  https   git k8s io community contributors devel sig architecture api conventions md spec and status      status     a href    FlowSchemaStatus  a       status  is the current status of a FlowSchema  More info  https   git k8s io community contributors devel sig architecture api conventions md spec and status         FlowSchemaSpec   FlowSchemaSpec   FlowSchemaSpec describes how the FlowSchema s specification looks like    hr       distinguisherMethod    FlowDistinguisherMethod      distinguisherMethod  defines how to compute the flow distinguisher for requests that match this schema   nil  specifies that the distinguisher is disabled and thus will always be the empty string      a name  FlowDistinguisherMethod    a     FlowDistinguisherMethod specifies the method of a flow distinguisher          distinguisherMethod type    string   required       type  is the type of flow distinguisher method The supported types are  ByUser  and  ByNamespace   Required       matchingPrecedence    int32      matchingPrecedence  is used to choose among the FlowSchemas that match a given request  The chosen FlowSchema is among those with the numerically lowest  which we take to be logically highest  MatchingPrecedence   Each MatchingPrecedence value must be ranged in  1 10000   Note that if the precedence is not specified  it will be set to 1000 as default       priorityLevelConfiguration    PriorityLevelConfigurationReference   required     priorityLevelConfiguration  should reference a PriorityLevelConfiguration in the cluster  If the reference cannot be resolved  the FlowSchema will be ignored and marked as invalid in its status  Required      a name  PriorityLevelConfigurationReference    a     PriorityLevelConfigurationReference contains information that points to the  request priority  being used          priorityLevelConfiguration name    string   required       name  is the name of the priority level configuration being referenced Required       rules      PolicyRulesWithSubjects      Atomic  will be replaced during a merge        rules  describes which requests will match this flow schema  This FlowSchema matches a request if and only if at least one member of rules matches the request  if it is an empty slice  there will be no requests matching the FlowSchema      a name  PolicyRulesWithSubjects    a     PolicyRulesWithSubjects prescribes a test that applies to a request to an apiserver  The test considers the subject making the request  the verb being requested  and the resource to be acted upon  This PolicyRulesWithSubjects matches a request if and only if both  a  at least one member of subjects matches the request and  b  at least one member of resourceRules or nonResourceRules matches the request          rules subjects      Subject   required       Atomic  will be replaced during a merge           subjects is the list of normal user  serviceaccount  or group that this rule cares about  There must be at least one member in this slice  A slice that includes both the system authenticated and system unauthenticated user groups matches every request  Required        a name  Subject    a       Subject matches the originator of a request  as identified by the request authentication system  There are three ways of matching an originator  by user  group  or service account            rules subjects kind    string   required         kind  indicates which one of the other fields is non empty  Required          rules subjects group    GroupSubject          group  matches based on user group name          a name  GroupSubject    a         GroupSubject holds detailed information for group kind subject              rules subjects group name    string   required          name is the user group that matches  or     to match all user groups  See https   github com kubernetes apiserver blob master pkg authentication user user go for some well known group names  Required           rules subjects serviceAccount    ServiceAccountSubject          serviceAccount  matches ServiceAccounts          a name  ServiceAccountSubject    a         ServiceAccountSubject holds detailed information for service account kind subject              rules subjects serviceAccount name    string   required           name  is the name of matching ServiceAccount objects  or     to match regardless of name  Required             rules subjects serviceAccount namespace    string   required           namespace  is the namespace of matching ServiceAccount objects  Required           rules subjects user    UserSubject          user  matches based on username          a name  UserSubject    a         UserSubject holds detailed information for user kind subject              rules subjects user name    string   required           name  is the username that matches  or     to match all usernames  Required         rules nonResourceRules      NonResourcePolicyRule        Atomic  will be replaced during a merge            nonResourceRules  is a list of NonResourcePolicyRules that identify matching requests according to their verb and the target non resource URL        a name  NonResourcePolicyRule    a       NonResourcePolicyRule is a predicate that matches non resource requests according to their verb and the target non resource URL  A NonResourcePolicyRule matches a request if and only if both  a  at least one member of verbs matches the request and  b  at least one member of nonResourceURLs matches the request            rules nonResourceRules nonResourceURLs      string   required         Set  unique values will be kept during a merge                nonResourceURLs  is a set of url prefixes that a user should have access to and may not be empty  For example              healthz  is legal             hea   is illegal             hea  is legal but matches nothing             hea    also matches nothing             healthz    matches all per component health checks            matches all non resource urls  if it is present  it must be the only entry  Required           rules nonResourceRules verbs      string   required         Set  unique values will be kept during a merge                verbs  is a list of matching verbs and may not be empty      matches all verbs  If it is present  it must be the only entry  Required         rules resourceRules      ResourcePolicyRule        Atomic  will be replaced during a merge            resourceRules  is a slice of ResourcePolicyRules that identify matching requests according to their verb and the target resource  At least one of  resourceRules  and  nonResourceRules  has to be non empty        a name  ResourcePolicyRule    a       ResourcePolicyRule is a predicate that matches some resource requests  testing the request s verb and the target resource  A ResourcePolicyRule matches a resource request if and only if   a  at least one member of verbs matches the request   b  at least one member of apiGroups matches the request   c  at least one member of resources matches the request  and  d  either  d1  the request does not specify a namespace  i e    Namespace       and clusterScope is true or  d2  the request specifies a namespace and least one member of namespaces matches the request s namespace            rules resourceRules apiGroups      string   required         Set  unique values will be kept during a merge                apiGroups  is a list of matching API groups and may not be empty      matches all API groups and  if present  must be the only entry  Required           rules resourceRules resources      string   required         Set  unique values will be kept during a merge                resources  is a list of matching resources  i e   lowercase and plural  with  if desired  subresource   For example     services    nodes status      This list may not be empty      matches all resources and  if present  must be the only entry  Required           rules resourceRules verbs      string   required         Set  unique values will be kept during a merge                verbs  is a list of matching verbs and may not be empty      matches all verbs and  if present  must be the only entry  Required           rules resourceRules clusterScope    boolean          clusterScope  indicates whether to match requests that do not specify a namespace  which happens either because the resource is not namespaced or the request targets all namespaces   If this field is omitted or false then the  namespaces  field must contain a non empty list           rules resourceRules namespaces      string          Set  unique values will be kept during a merge                namespaces  is a list of target namespaces that restricts matches   A request that specifies a target namespace matches only if either  a  this list contains that target namespace or  b  this list contains       Note that     matches any specified namespace but does not match a request that  does not specify  a namespace  see the  clusterScope  field for that   This list may be empty  but only if  clusterScope  is true          FlowSchemaStatus   FlowSchemaStatus   FlowSchemaStatus represents the current state of a FlowSchema    hr       conditions      FlowSchemaCondition      Patch strategy  merge on key  type         Map  unique values on key type will be kept during a merge        conditions  is a list of the current states of FlowSchema      a name  FlowSchemaCondition    a     FlowSchemaCondition describes conditions for a FlowSchema          conditions lastTransitionTime    Time        lastTransitionTime  is the last time the condition transitioned from one status to another        a name  Time    a       Time is a wrapper around time Time which supports correct marshaling to YAML and JSON   Wrappers are provided for many of the factory methods that the time package offers          conditions message    string        message  is a human readable message indicating details about last transition         conditions reason    string        reason  is a unique  one word  CamelCase reason for the condition s last transition         conditions status    string        status  is the status of the condition  Can be True  False  Unknown  Required         conditions type    string        type  is the type of the condition  Required          FlowSchemaList   FlowSchemaList   FlowSchemaList is a list of FlowSchema objects    hr       apiVersion    flowcontrol apiserver k8s io v1       kind    FlowSchemaList       metadata     a href    ListMeta  a       metadata  is the standard list metadata  More info  https   git k8s io community contributors devel sig architecture api conventions md metadata      items       a href    FlowSchema  a    required     items  is a list of FlowSchemas          Operations   Operations      hr             get  read the specified FlowSchema       HTTP Request  GET  apis flowcontrol apiserver k8s io v1 flowschemas  name        Parameters       name     in path    string  required    name of the FlowSchema       pretty     in query    string     a href    pretty  a          Response   200   a href    FlowSchema  a    OK  401  Unauthorized        get  read status of the specified FlowSchema       HTTP Request  GET  apis flowcontrol apiserver k8s io v1 flowschemas  name  status       Parameters       name     in path    string  required    name of the FlowSchema       pretty     in query    string     a href    pretty  a          Response   200   a href    FlowSchema  a    OK  401  Unauthorized        list  list or watch objects of kind FlowSchema       HTTP Request  GET  apis flowcontrol apiserver k8s io v1 flowschemas       Parameters       allowWatchBookmarks     in query    boolean     a href    allowWatchBookmarks  a        continue     in query    string     a href    continue  a        fieldSelector     in query    string     a href    fieldSelector  a        labelSelector     in query    string     a href    labelSelector  a        limit     in query    integer     a href    limit  a        pretty     in query    string     a href    pretty  a        resourceVersion     in query    string     a href    resourceVersion  a        resourceVersionMatch     in query    string     a href    resourceVersionMatch  a        sendInitialEvents     in query    boolean     a href    sendInitialEvents  a        timeoutSeconds     in query    integer     a href    timeoutSeconds  a        watch     in query    boolean     a href    watch  a          Response   200   a href    FlowSchemaList  a    OK  401  Unauthorized        create  create a FlowSchema       HTTP Request  POST  apis flowcontrol apiserver k8s io v1 flowschemas       Parameters       body     a href    FlowSchema  a   required           dryRun     in query    string     a href    dryRun  a        fieldManager     in query    string     a href    fieldManager  a        fieldValidation     in query    string     a href    fieldValidation  a        pretty     in query    string     a href    pretty  a          Response   200   a href    FlowSchema  a    OK  201   a href    FlowSchema  a    Created  202   a href    FlowSchema  a    Accepted  401  Unauthorized        update  replace the specified FlowSchema       HTTP Request  PUT  apis flowcontrol apiserver k8s io v1 flowschemas  name        Parameters       name     in path    string  required    name of the FlowSchema       body     a href    FlowSchema  a   required           dryRun     in query    string     a href    dryRun  a        fieldManager     in query    string     a href    fieldManager  a        fieldValidation     in query    string     a href    fieldValidation  a        pretty     in query    string     a href    pretty  a          Response   200   a href    FlowSchema  a    OK  201   a href    FlowSchema  a    Created  401  Unauthorized        update  replace status of the specified FlowSchema       HTTP Request  PUT  apis flowcontrol apiserver k8s io v1 flowschemas  name  status       Parameters       name     in path    string  required    name of the FlowSchema       body     a href    FlowSchema  a   required           dryRun     in query    string     a href    dryRun  a        fieldManager     in query    string     a href    fieldManager  a        fieldValidation     in query    string     a href    fieldValidation  a        pretty     in query    string     a href    pretty  a          Response   200   a href    FlowSchema  a    OK  201   a href    FlowSchema  a    Created  401  Unauthorized        patch  partially update the specified FlowSchema       HTTP Request  PATCH  apis flowcontrol apiserver k8s io v1 flowschemas  name        Parameters       name     in path    string  required    name of the FlowSchema       body     a href    Patch  a   required           dryRun     in query    string     a href    dryRun  a        fieldManager     in query    string     a href    fieldManager  a        fieldValidation     in query    string     a href    fieldValidation  a        force     in query    boolean     a href    force  a        pretty     in query    string     a href    pretty  a          Response   200   a href    FlowSchema  a    OK  201   a href    FlowSchema  a    Created  401  Unauthorized        patch  partially update status of the specified FlowSchema       HTTP Request  PATCH  apis flowcontrol apiserver k8s io v1 flowschemas  name  status       Parameters       name     in path    string  required    name of the FlowSchema       body     a href    Patch  a   required           dryRun     in query    string     a href    dryRun  a        fieldManager     in query    string     a href    fieldManager  a        fieldValidation     in query    string     a href    fieldValidation  a        force     in query    boolean     a href    force  a        pretty     in query    string     a href    pretty  a          Response   200   a href    FlowSchema  a    OK  201   a href    FlowSchema  a    Created  401  Unauthorized        delete  delete a FlowSchema       HTTP Request  DELETE  apis flowcontrol apiserver k8s io v1 flowschemas  name        Parameters       name     in path    string  required    name of the FlowSchema       body     a href    DeleteOptions  a            dryRun     in query    string     a href    dryRun  a        gracePeriodSeconds     in query    integer     a href    gracePeriodSeconds  a        pretty     in query    string     a href    pretty  a        propagationPolicy     in query    string     a href    propagationPolicy  a          Response   200   a href    Status  a    OK  202   a href    Status  a    Accepted  401  Unauthorized        deletecollection  delete collection of FlowSchema       HTTP Request  DELETE  apis flowcontrol apiserver k8s io v1 flowschemas       Parameters       body     a href    DeleteOptions  a            continue     in query    string     a href    continue  a        dryRun     in query    string     a href    dryRun  a        fieldSelector     in query    string     a href    fieldSelector  a        gracePeriodSeconds     in query    integer     a href    gracePeriodSeconds  a        labelSelector     in query    string     a href    labelSelector  a        limit     in query    integer     a href    limit  a        pretty     in query    string     a href    pretty  a        propagationPolicy     in query    string     a href    propagationPolicy  a        resourceVersion     in query    string     a href    resourceVersion  a        resourceVersionMatch     in query    string     a href    resourceVersionMatch  a        sendInitialEvents     in query    boolean     a href    sendInitialEvents  a        timeoutSeconds     in query    integer     a href    timeoutSeconds  a          Response   200   a href    Status  a    OK  401  Unauthorized