kubernetes reference contenttype tool reference Resource Types package kubeproxy config k8s io v1alpha1 autogenerated true title kube proxy Configuration v1alpha1

Answer:
---
title: kube-proxy Configuration (v1alpha1)
content_type: tool-reference
package: kubeproxy.config.k8s.io/v1alpha1
auto_generated: true
---

## Resource Types

- [KubeProxyConfiguration](#kubeproxy-config-k8s-io-v1alpha1-KubeProxyConfiguration)

## `ClientConnectionConfiguration`     {#ClientConnectionConfiguration}

**Appears in:**

- [KubeProxyConfiguration](#kubeproxy-config-k8s-io-v1alpha1-KubeProxyConfiguration)

- [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1-KubeSchedulerConfiguration)

- [GenericControllerManagerConfiguration](#controllermanager-config-k8s-io-v1alpha1-GenericControllerManagerConfiguration)

ClientConnectionConfiguration contains details for constructing a client.

Field	Description

kubeconfig [Required]

string

kubeconfig is the path to a KubeConfig file.

acceptContentTypes [Required]

string

acceptContentTypes defines the Accept header sent by clients when connecting to a server, overriding the
default value of 'application/json'. This field will control all connections to the server used by a particular
client.

contentType [Required]

string

contentType is the content type used when sending data to the server from this client.

qps [Required]

float32

qps controls the number of queries per second allowed for this connection.

burst [Required]

int32

burst allows extra queries to accumulate when a client is exceeding its rate.

## `DebuggingConfiguration`     {#DebuggingConfiguration}

**Appears in:**

- [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1-KubeSchedulerConfiguration)

- [GenericControllerManagerConfiguration](#controllermanager-config-k8s-io-v1alpha1-GenericControllerManagerConfiguration)

DebuggingConfiguration holds configuration for Debugging related features.

Field	Description

enableProfiling [Required]

bool

enableProfiling enables profiling via web interface host:port/debug/pprof/

enableContentionProfiling [Required]

bool

enableContentionProfiling enables block profiling, if
enableProfiling is true.

## `LeaderElectionConfiguration`     {#LeaderElectionConfiguration}

**Appears in:**

- [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1-KubeSchedulerConfiguration)

- [GenericControllerManagerConfiguration](#controllermanager-config-k8s-io-v1alpha1-GenericControllerManagerConfiguration)

LeaderElectionConfiguration defines the configuration of leader election
clients for components that can run with leader election enabled.

Field	Description

leaderElect [Required]

bool

leaderElect enables a leader election client to gain leadership
before executing the main loop. Enable this when running replicated
components for high availability.

leaseDuration [Required]

meta/v1.Duration

leaseDuration is the duration that non-leader candidates will wait
after observing a leadership renewal until attempting to acquire
leadership of a led but unrenewed leader slot. This is effectively the
maximum duration that a leader can be stopped before it is replaced
by another candidate. This is only applicable if leader election is
enabled.

renewDeadline [Required]

meta/v1.Duration

renewDeadline is the interval between attempts by the acting master to
renew a leadership slot before it stops leading. This must be less
than or equal to the lease duration. This is only applicable if leader
election is enabled.

retryPeriod [Required]

meta/v1.Duration

retryPeriod is the duration the clients should wait between attempting
acquisition and renewal of a leadership. This is only applicable if
leader election is enabled.

resourceLock [Required]

string

resourceLock indicates the resource object type that will be used to lock
during leader election cycles.

resourceName [Required]

string

resourceName indicates the name of resource object that will be used to lock
during leader election cycles.

resourceNamespace [Required]

string

resourceName indicates the namespace of resource object that will be used to lock
during leader election cycles.

## `KubeProxyConfiguration`     {#kubeproxy-config-k8s-io-v1alpha1-KubeProxyConfiguration}

KubeProxyConfiguration contains everything necessary to configure the
Kubernetes proxy server.

Field	Description

apiVersion
string	kubeproxy.config.k8s.io/v1alpha1

kind
string	KubeProxyConfiguration

featureGates [Required]

map[string]bool

featureGates is a map of feature names to bools that enable or disable alpha/experimental features.

clientConnection [Required]

ClientConnectionConfiguration

clientConnection specifies the kubeconfig file and client connection settings for the proxy
server to use when communicating with the apiserver.

logging [Required]

LoggingConfiguration

logging specifies the options of logging.
Refer to Logs Options
for more information.

hostnameOverride [Required]

string

hostnameOverride, if non-empty, will be used as the name of the Node that
kube-proxy is running on. If unset, the node name is assumed to be the same as
the node's hostname.

bindAddress [Required]

string

bindAddress can be used to override kube-proxy's idea of what its node's
primary IP is. Note that the name is a historical artifact, and kube-proxy does
not actually bind any sockets to this IP.

healthzBindAddress [Required]

string

healthzBindAddress is the IP address and port for the health check server to
serve on, defaulting to "0.0.0.0:10256" (if bindAddress is unset or IPv4), or
"[::]:10256" (if bindAddress is IPv6).

metricsBindAddress [Required]

string

metricsBindAddress is the IP address and port for the metrics server to serve
on, defaulting to "127.0.0.1:10249" (if bindAddress is unset or IPv4), or
"[::1]:10249" (if bindAddress is IPv6). (Set to "0.0.0.0:10249" / "[::]:10249"
to bind on all interfaces.)

bindAddressHardFail [Required]

bool

bindAddressHardFail, if true, tells kube-proxy to treat failure to bind to a
port as fatal and exit

enableProfiling [Required]

bool

enableProfiling enables profiling via web interface on /debug/pprof handler.
Profiling handlers will be handled by metrics server.

showHiddenMetricsForVersion [Required]

string

showHiddenMetricsForVersion is the version for which you want to show hidden metrics.

mode [Required]

ProxyMode

mode specifies which proxy mode to use.

iptables [Required]

KubeProxyIPTablesConfiguration

iptables contains iptables-related configuration options.

ipvs [Required]

KubeProxyIPVSConfiguration

ipvs contains ipvs-related configuration options.

nftables [Required]

KubeProxyNFTablesConfiguration

nftables contains nftables-related configuration options.

winkernel [Required]

KubeProxyWinkernelConfiguration

winkernel contains winkernel-related configuration options.

detectLocalMode [Required]

LocalMode

detectLocalMode determines mode to use for detecting local traffic, defaults to ClusterCIDR

detectLocal [Required]

DetectLocalConfiguration

detectLocal contains optional configuration settings related to DetectLocalMode.

clusterCIDR [Required]

string

clusterCIDR is the CIDR range of the pods in the cluster. (For dual-stack
clusters, this can be a comma-separated dual-stack pair of CIDR ranges.). When
DetectLocalMode is set to ClusterCIDR, kube-proxy will consider
traffic to be local if its source IP is in this range. (Otherwise it is not
used.)

nodePortAddresses [Required]

[]string

nodePortAddresses is a list of CIDR ranges that contain valid node IPs, or
alternatively, the single string 'primary'. If set to a list of CIDRs,
connections to NodePort services will only be accepted on node IPs in one of
the indicated ranges. If set to 'primary', NodePort services will only be
accepted on the node's primary IPv4 and/or IPv6 address according to the Node
object. If unset, NodePort connections will be accepted on all local IPs.

oomScoreAdj [Required]

int32

oomScoreAdj is the oom-score-adj value for kube-proxy process. Values must be within
the range [-1000, 1000]

conntrack [Required]

KubeProxyConntrackConfiguration

conntrack contains conntrack-related configuration options.

configSyncPeriod [Required]

meta/v1.Duration

configSyncPeriod is how often configuration from the apiserver is refreshed. Must be greater
than 0.

portRange [Required]

string

portRange was previously used to configure the userspace proxy, but is now unused.

windowsRunAsService [Required]

bool

windowsRunAsService, if true, enables Windows service control manager API integration.

## `DetectLocalConfiguration`     {#kubeproxy-config-k8s-io-v1alpha1-DetectLocalConfiguration}

**Appears in:**

- [KubeProxyConfiguration](#kubeproxy-config-k8s-io-v1alpha1-KubeProxyConfiguration)

DetectLocalConfiguration contains optional settings related to DetectLocalMode option

Field	Description

bridgeInterface [Required]

string

bridgeInterface is a bridge interface name. When DetectLocalMode is set to
LocalModeBridgeInterface, kube-proxy will consider traffic to be local if
it originates from this bridge.

interfaceNamePrefix [Required]

string

interfaceNamePrefix is an interface name prefix. When DetectLocalMode is set to
LocalModeInterfaceNamePrefix, kube-proxy will consider traffic to be local if
it originates from any interface whose name begins with this prefix.

## `KubeProxyConntrackConfiguration`     {#kubeproxy-config-k8s-io-v1alpha1-KubeProxyConntrackConfiguration}

**Appears in:**

- [KubeProxyConfiguration](#kubeproxy-config-k8s-io-v1alpha1-KubeProxyConfiguration)

KubeProxyConntrackConfiguration contains conntrack settings for
the Kubernetes proxy server.

Field	Description

maxPerCore [Required]

int32

maxPerCore is the maximum number of NAT connections to track
per CPU core (0 to leave the limit as-is and ignore min).

min [Required]

int32

min is the minimum value of connect-tracking records to allocate,
regardless of maxPerCore (set maxPerCore=0 to leave the limit as-is).

tcpEstablishedTimeout [Required]

meta/v1.Duration

tcpEstablishedTimeout is how long an idle TCP connection will be kept open
(e.g. '2s').  Must be greater than 0 to set.

tcpCloseWaitTimeout [Required]

meta/v1.Duration

tcpCloseWaitTimeout is how long an idle conntrack entry
in CLOSE_WAIT state will remain in the conntrack
table. (e.g. '60s'). Must be greater than 0 to set.

tcpBeLiberal [Required]

bool

tcpBeLiberal, if true, kube-proxy will configure conntrack
to run in liberal mode for TCP connections and packets with
out-of-window sequence numbers won't be marked INVALID.

udpTimeout [Required]

meta/v1.Duration

udpTimeout is how long an idle UDP conntrack entry in
UNREPLIED state will remain in the conntrack table
(e.g. '30s'). Must be greater than 0 to set.

udpStreamTimeout [Required]

meta/v1.Duration

udpStreamTimeout is how long an idle UDP conntrack entry in
ASSURED state will remain in the conntrack table
(e.g. '300s'). Must be greater than 0 to set.

## `KubeProxyIPTablesConfiguration`     {#kubeproxy-config-k8s-io-v1alpha1-KubeProxyIPTablesConfiguration}

**Appears in:**

- [KubeProxyConfiguration](#kubeproxy-config-k8s-io-v1alpha1-KubeProxyConfiguration)

KubeProxyIPTablesConfiguration contains iptables-related configuration
details for the Kubernetes proxy server.

Field	Description

masqueradeBit [Required]

int32

masqueradeBit is the bit of the iptables fwmark space to use for SNAT if using
the iptables or ipvs proxy mode. Values must be within the range [0, 31].

masqueradeAll [Required]

bool

masqueradeAll tells kube-proxy to SNAT all traffic sent to Service cluster IPs,
when using the iptables or ipvs proxy mode. This may be required with some CNI
plugins.

localhostNodePorts [Required]

bool

localhostNodePorts, if false, tells kube-proxy to disable the legacy behavior
of allowing NodePort services to be accessed via localhost. (Applies only to
iptables mode and IPv4; localhost NodePorts are never allowed with other proxy
modes or with IPv6.)

syncPeriod [Required]

meta/v1.Duration

syncPeriod is an interval (e.g. '5s', '1m', '2h22m') indicating how frequently
various re-synchronizing and cleanup operations are performed. Must be greater
than 0.

minSyncPeriod [Required]

meta/v1.Duration

minSyncPeriod is the minimum period between iptables rule resyncs (e.g. '5s',
'1m', '2h22m'). A value of 0 means every Service or EndpointSlice change will
result in an immediate iptables resync.

## `KubeProxyIPVSConfiguration`     {#kubeproxy-config-k8s-io-v1alpha1-KubeProxyIPVSConfiguration}

**Appears in:**

- [KubeProxyConfiguration](#kubeproxy-config-k8s-io-v1alpha1-KubeProxyConfiguration)

KubeProxyIPVSConfiguration contains ipvs-related configuration
details for the Kubernetes proxy server.

Field	Description

syncPeriod [Required]

meta/v1.Duration

syncPeriod is an interval (e.g. '5s', '1m', '2h22m') indicating how frequently
various re-synchronizing and cleanup operations are performed. Must be greater
than 0.

minSyncPeriod [Required]

meta/v1.Duration

minSyncPeriod is the minimum period between IPVS rule resyncs (e.g. '5s', '1m',
'2h22m'). A value of 0 means every Service or EndpointSlice change will result
in an immediate IPVS resync.

scheduler [Required]

string

scheduler is the IPVS scheduler to use

excludeCIDRs [Required]

[]string

excludeCIDRs is a list of CIDRs which the ipvs proxier should not touch
when cleaning up ipvs services.

strictARP [Required]

bool

strictARP configures arp_ignore and arp_announce to avoid answering ARP queries
from kube-ipvs0 interface

tcpTimeout [Required]

meta/v1.Duration

tcpTimeout is the timeout value used for idle IPVS TCP sessions.
The default value is 0, which preserves the current timeout value on the system.

tcpFinTimeout [Required]

meta/v1.Duration

tcpFinTimeout is the timeout value used for IPVS TCP sessions after receiving a FIN.
The default value is 0, which preserves the current timeout value on the system.

udpTimeout [Required]

meta/v1.Duration

udpTimeout is the timeout value used for IPVS UDP packets.
The default value is 0, which preserves the current timeout value on the system.

## `KubeProxyNFTablesConfiguration`     {#kubeproxy-config-k8s-io-v1alpha1-KubeProxyNFTablesConfiguration}

**Appears in:**

- [KubeProxyConfiguration](#kubeproxy-config-k8s-io-v1alpha1-KubeProxyConfiguration)

KubeProxyNFTablesConfiguration contains nftables-related configuration
details for the Kubernetes proxy server.

Field	Description

masqueradeBit [Required]

int32

masqueradeBit is the bit of the iptables fwmark space to use for SNAT if using
the nftables proxy mode. Values must be within the range [0, 31].

masqueradeAll [Required]

bool

masqueradeAll tells kube-proxy to SNAT all traffic sent to Service cluster IPs,
when using the nftables mode. This may be required with some CNI plugins.

syncPeriod [Required]

meta/v1.Duration

syncPeriod is an interval (e.g. '5s', '1m', '2h22m') indicating how frequently
various re-synchronizing and cleanup operations are performed. Must be greater
than 0.

minSyncPeriod [Required]

meta/v1.Duration

minSyncPeriod is the minimum period between iptables rule resyncs (e.g. '5s',
'1m', '2h22m'). A value of 0 means every Service or EndpointSlice change will
result in an immediate iptables resync.

## `KubeProxyWinkernelConfiguration`     {#kubeproxy-config-k8s-io-v1alpha1-KubeProxyWinkernelConfiguration}

**Appears in:**

- [KubeProxyConfiguration](#kubeproxy-config-k8s-io-v1alpha1-KubeProxyConfiguration)

KubeProxyWinkernelConfiguration contains Windows/HNS settings for
the Kubernetes proxy server.

Field	Description

networkName [Required]

string

networkName is the name of the network kube-proxy will use
to create endpoints and policies

sourceVip [Required]

string

sourceVip is the IP address of the source VIP endpoint used for
NAT when loadbalancing

enableDSR [Required]

bool

enableDSR tells kube-proxy whether HNS policies should be created
with DSR

rootHnsEndpointName [Required]

string

rootHnsEndpointName is the name of hnsendpoint that is attached to
l2bridge for root network namespace

forwardHealthCheckVip [Required]

bool

forwardHealthCheckVip forwards service VIP for health check port on
Windows

## `LocalMode`     {#kubeproxy-config-k8s-io-v1alpha1-LocalMode}

(Alias of `string`)

**Appears in:**

- [KubeProxyConfiguration](#kubeproxy-config-k8s-io-v1alpha1-KubeProxyConfiguration)

LocalMode represents modes to detect local traffic from the node

## `ProxyMode`     {#kubeproxy-config-k8s-io-v1alpha1-ProxyMode}

(Alias of `string`)

**Appears in:**

- [KubeProxyConfiguration](#kubeproxy-config-k8s-io-v1alpha1-KubeProxyConfiguration)

ProxyMode represents modes used by the Kubernetes proxy server.

Currently, two modes of proxy are available on Linux platforms: 'iptables' and 'ipvs'.
One mode of proxy is available on Windows platforms: 'kernelspace'.

If the proxy mode is unspecified, the best-available proxy mode will be used (currently this
is iptables on Linux and kernelspace on Windows). If the selected proxy mode cannot be
used (due to lack of kernel support, missing userspace components, etc) then kube-proxy
will exit with an error.

title  kube proxy Configuration  v1alpha1  content type  tool reference package  kubeproxy config k8s io v1alpha1 auto generated  true          Resource Types       KubeProxyConfiguration   kubeproxy config k8s io v1alpha1 KubeProxyConfiguration                    ClientConnectionConfiguration        ClientConnectionConfiguration          Appears in        KubeProxyConfiguration   kubeproxy config k8s io v1alpha1 KubeProxyConfiguration      KubeSchedulerConfiguration   kubescheduler config k8s io v1 KubeSchedulerConfiguration      GenericControllerManagerConfiguration   controllermanager config k8s io v1alpha1 GenericControllerManagerConfiguration     p ClientConnectionConfiguration contains details for constructing a client   p     table class  table    thead  tr  th width  30   Field  th  th Description  th   tr   thead   tbody           tr  td  code kubeconfig  code   B  Required   B  br    code string  code    td   td      p kubeconfig is the path to a KubeConfig file   p    td    tr   tr  td  code acceptContentTypes  code   B  Required   B  br    code string  code    td   td      p acceptContentTypes defines the Accept header sent by clients when connecting to a server  overriding the default value of  application json   This field will control all connections to the server used by a particular client   p    td    tr   tr  td  code contentType  code   B  Required   B  br    code string  code    td   td      p contentType is the content type used when sending data to the server from this client   p    td    tr   tr  td  code qps  code   B  Required   B  br    code float32  code    td   td      p qps controls the number of queries per second allowed for this connection   p    td    tr   tr  td  code burst  code   B  Required   B  br    code int32  code    td   td      p burst allows extra queries to accumulate when a client is exceeding its rate   p    td    tr    tbody    table       DebuggingConfiguration        DebuggingConfiguration          Appears in        KubeSchedulerConfiguration   kubescheduler config k8s io v1 KubeSchedulerConfiguration      GenericControllerManagerConfiguration   controllermanager config k8s io v1alpha1 GenericControllerManagerConfiguration     p DebuggingConfiguration holds configuration for Debugging related features   p     table class  table    thead  tr  th width  30   Field  th  th Description  th   tr   thead   tbody           tr  td  code enableProfiling  code   B  Required   B  br    code bool  code    td   td      p enableProfiling enables profiling via web interface host port debug pprof   p    td    tr   tr  td  code enableContentionProfiling  code   B  Required   B  br    code bool  code    td   td      p enableContentionProfiling enables block profiling  if enableProfiling is true   p    td    tr    tbody    table       LeaderElectionConfiguration        LeaderElectionConfiguration          Appears in        KubeSchedulerConfiguration   kubescheduler config k8s io v1 KubeSchedulerConfiguration      GenericControllerManagerConfiguration   controllermanager config k8s io v1alpha1 GenericControllerManagerConfiguration     p LeaderElectionConfiguration defines the configuration of leader election clients for components that can run with leader election enabled   p     table class  table    thead  tr  th width  30   Field  th  th Description  th   tr   thead   tbody           tr  td  code leaderElect  code   B  Required   B  br    code bool  code    td   td      p leaderElect enables a leader election client to gain leadership before executing the main loop  Enable this when running replicated components for high availability   p    td    tr   tr  td  code leaseDuration  code   B  Required   B  br    a href  https   pkg go dev k8s io apimachinery pkg apis meta v1 Duration   code meta v1 Duration  code   a    td   td      p leaseDuration is the duration that non leader candidates will wait after observing a leadership renewal until attempting to acquire leadership of a led but unrenewed leader slot  This is effectively the maximum duration that a leader can be stopped before it is replaced by another candidate  This is only applicable if leader election is enabled   p    td    tr   tr  td  code renewDeadline  code   B  Required   B  br    a href  https   pkg go dev k8s io apimachinery pkg apis meta v1 Duration   code meta v1 Duration  code   a    td   td      p renewDeadline is the interval between attempts by the acting master to renew a leadership slot before it stops leading  This must be less than or equal to the lease duration  This is only applicable if leader election is enabled   p    td    tr   tr  td  code retryPeriod  code   B  Required   B  br    a href  https   pkg go dev k8s io apimachinery pkg apis meta v1 Duration   code meta v1 Duration  code   a    td   td      p retryPeriod is the duration the clients should wait between attempting acquisition and renewal of a leadership  This is only applicable if leader election is enabled   p    td    tr   tr  td  code resourceLock  code   B  Required   B  br    code string  code    td   td      p resourceLock indicates the resource object type that will be used to lock during leader election cycles   p    td    tr   tr  td  code resourceName  code   B  Required   B  br    code string  code    td   td      p resourceName indicates the name of resource object that will be used to lock during leader election cycles   p    td    tr   tr  td  code resourceNamespace  code   B  Required   B  br    code string  code    td   td      p resourceName indicates the namespace of resource object that will be used to lock during leader election cycles   p    td    tr    tbody    table          KubeProxyConfiguration        kubeproxy config k8s io v1alpha1 KubeProxyConfiguration          p KubeProxyConfiguration contains everything necessary to configure the Kubernetes proxy server   p     table class  table    thead  tr  th width  30   Field  th  th Description  th   tr   thead   tbody        tr  td  code apiVersion  code  br  string  td  td  code kubeproxy config k8s io v1alpha1  code   td   tr   tr  td  code kind  code  br  string  td  td  code KubeProxyConfiguration  code   td   tr           tr  td  code featureGates  code   B  Required   B  br    code map string bool  code    td   td      p featureGates is a map of feature names to bools that enable or disable alpha experimental features   p    td    tr   tr  td  code clientConnection  code   B  Required   B  br    a href   ClientConnectionConfiguration   code ClientConnectionConfiguration  code   a    td   td      p clientConnection specifies the kubeconfig file and client connection settings for the proxy server to use when communicating with the apiserver   p    td    tr   tr  td  code logging  code   B  Required   B  br    a href   LoggingConfiguration   code LoggingConfiguration  code   a    td   td      p logging specifies the options of logging  Refer to  a href  https   github com kubernetes component base blob master logs options go  Logs Options  a  for more information   p    td    tr   tr  td  code hostnameOverride  code   B  Required   B  br    code string  code    td   td      p hostnameOverride  if non empty  will be used as the name of the Node that kube proxy is running on  If unset  the node name is assumed to be the same as the node s hostname   p    td    tr   tr  td  code bindAddress  code   B  Required   B  br    code string  code    td   td      p bindAddress can be used to override kube proxy s idea of what its node s primary IP is  Note that the name is a historical artifact  and kube proxy does not actually bind any sockets to this IP   p    td    tr   tr  td  code healthzBindAddress  code   B  Required   B  br    code string  code    td   td      p healthzBindAddress is the IP address and port for the health check server to serve on  defaulting to  quot 0 0 0 0 10256 quot   if bindAddress is unset or IPv4   or  quot      10256 quot   if bindAddress is IPv6    p    td    tr   tr  td  code metricsBindAddress  code   B  Required   B  br    code string  code    td   td      p metricsBindAddress is the IP address and port for the metrics server to serve on  defaulting to  quot 127 0 0 1 10249 quot   if bindAddress is unset or IPv4   or  quot    1  10249 quot   if bindAddress is IPv6    Set to  quot 0 0 0 0 10249 quot     quot      10249 quot  to bind on all interfaces    p    td    tr   tr  td  code bindAddressHardFail  code   B  Required   B  br    code bool  code    td   td      p bindAddressHardFail  if true  tells kube proxy to treat failure to bind to a port as fatal and exit  p    td    tr   tr  td  code enableProfiling  code   B  Required   B  br    code bool  code    td   td      p enableProfiling enables profiling via web interface on  debug pprof handler  Profiling handlers will be handled by metrics server   p    td    tr   tr  td  code showHiddenMetricsForVersion  code   B  Required   B  br    code string  code    td   td      p showHiddenMetricsForVersion is the version for which you want to show hidden metrics   p    td    tr   tr  td  code mode  code   B  Required   B  br    a href   kubeproxy config k8s io v1alpha1 ProxyMode   code ProxyMode  code   a    td   td      p mode specifies which proxy mode to use   p    td    tr   tr  td  code iptables  code   B  Required   B  br    a href   kubeproxy config k8s io v1alpha1 KubeProxyIPTablesConfiguration   code KubeProxyIPTablesConfiguration  code   a    td   td      p iptables contains iptables related configuration options   p    td    tr   tr  td  code ipvs  code   B  Required   B  br    a href   kubeproxy config k8s io v1alpha1 KubeProxyIPVSConfiguration   code KubeProxyIPVSConfiguration  code   a    td   td      p ipvs contains ipvs related configuration options   p    td    tr   tr  td  code nftables  code   B  Required   B  br    a href   kubeproxy config k8s io v1alpha1 KubeProxyNFTablesConfiguration   code KubeProxyNFTablesConfiguration  code   a    td   td      p nftables contains nftables related configuration options   p    td    tr   tr  td  code winkernel  code   B  Required   B  br    a href   kubeproxy config k8s io v1alpha1 KubeProxyWinkernelConfiguration   code KubeProxyWinkernelConfiguration  code   a    td   td      p winkernel contains winkernel related configuration options   p    td    tr   tr  td  code detectLocalMode  code   B  Required   B  br    a href   kubeproxy config k8s io v1alpha1 LocalMode   code LocalMode  code   a    td   td      p detectLocalMode determines mode to use for detecting local traffic  defaults to ClusterCIDR  p    td    tr   tr  td  code detectLocal  code   B  Required   B  br    a href   kubeproxy config k8s io v1alpha1 DetectLocalConfiguration   code DetectLocalConfiguration  code   a    td   td      p detectLocal contains optional configuration settings related to DetectLocalMode   p    td    tr   tr  td  code clusterCIDR  code   B  Required   B  br    code string  code    td   td      p clusterCIDR is the CIDR range of the pods in the cluster   For dual stack clusters  this can be a comma separated dual stack pair of CIDR ranges    When DetectLocalMode is set to ClusterCIDR  kube proxy will consider traffic to be local if its source IP is in this range   Otherwise it is not used    p    td    tr   tr  td  code nodePortAddresses  code   B  Required   B  br    code   string  code    td   td      p nodePortAddresses is a list of CIDR ranges that contain valid node IPs  or alternatively  the single string  primary   If set to a list of CIDRs  connections to NodePort services will only be accepted on node IPs in one of the indicated ranges  If set to  primary   NodePort services will only be accepted on the node s primary IPv4 and or IPv6 address according to the Node object  If unset  NodePort connections will be accepted on all local IPs   p    td    tr   tr  td  code oomScoreAdj  code   B  Required   B  br    code int32  code    td   td      p oomScoreAdj is the oom score adj value for kube proxy process  Values must be within the range   1000  1000   p    td    tr   tr  td  code conntrack  code   B  Required   B  br    a href   kubeproxy config k8s io v1alpha1 KubeProxyConntrackConfiguration   code KubeProxyConntrackConfiguration  code   a    td   td      p conntrack contains conntrack related configuration options   p    td    tr   tr  td  code configSyncPeriod  code   B  Required   B  br    a href  https   pkg go dev k8s io apimachinery pkg apis meta v1 Duration   code meta v1 Duration  code   a    td   td      p configSyncPeriod is how often configuration from the apiserver is refreshed  Must be greater than 0   p    td    tr   tr  td  code portRange  code   B  Required   B  br    code string  code    td   td      p portRange was previously used to configure the userspace proxy  but is now unused   p    td    tr   tr  td  code windowsRunAsService  code   B  Required   B  br    code bool  code    td   td      p windowsRunAsService  if true  enables Windows service control manager API integration   p    td    tr    tbody    table       DetectLocalConfiguration        kubeproxy config k8s io v1alpha1 DetectLocalConfiguration          Appears in        KubeProxyConfiguration   kubeproxy config k8s io v1alpha1 KubeProxyConfiguration     p DetectLocalConfiguration contains optional settings related to DetectLocalMode option  p     table class  table    thead  tr  th width  30   Field  th  th Description  th   tr   thead   tbody           tr  td  code bridgeInterface  code   B  Required   B  br    code string  code    td   td      p bridgeInterface is a bridge interface name  When DetectLocalMode is set to LocalModeBridgeInterface  kube proxy will consider traffic to be local if it originates from this bridge   p    td    tr   tr  td  code interfaceNamePrefix  code   B  Required   B  br    code string  code    td   td      p interfaceNamePrefix is an interface name prefix  When DetectLocalMode is set to LocalModeInterfaceNamePrefix  kube proxy will consider traffic to be local if it originates from any interface whose name begins with this prefix   p    td    tr    tbody    table       KubeProxyConntrackConfiguration        kubeproxy config k8s io v1alpha1 KubeProxyConntrackConfiguration          Appears in        KubeProxyConfiguration   kubeproxy config k8s io v1alpha1 KubeProxyConfiguration     p KubeProxyConntrackConfiguration contains conntrack settings for the Kubernetes proxy server   p     table class  table    thead  tr  th width  30   Field  th  th Description  th   tr   thead   tbody           tr  td  code maxPerCore  code   B  Required   B  br    code int32  code    td   td      p maxPerCore is the maximum number of NAT connections to track per CPU core  0 to leave the limit as is and ignore min    p    td    tr   tr  td  code min  code   B  Required   B  br    code int32  code    td   td      p min is the minimum value of connect tracking records to allocate  regardless of maxPerCore  set maxPerCore 0 to leave the limit as is    p    td    tr   tr  td  code tcpEstablishedTimeout  code   B  Required   B  br    a href  https   pkg go dev k8s io apimachinery pkg apis meta v1 Duration   code meta v1 Duration  code   a    td   td      p tcpEstablishedTimeout is how long an idle TCP connection will be kept open  e g   2s     Must be greater than 0 to set   p    td    tr   tr  td  code tcpCloseWaitTimeout  code   B  Required   B  br    a href  https   pkg go dev k8s io apimachinery pkg apis meta v1 Duration   code meta v1 Duration  code   a    td   td      p tcpCloseWaitTimeout is how long an idle conntrack entry in CLOSE WAIT state will remain in the conntrack table   e g   60s    Must be greater than 0 to set   p    td    tr   tr  td  code tcpBeLiberal  code   B  Required   B  br    code bool  code    td   td      p tcpBeLiberal  if true  kube proxy will configure conntrack to run in liberal mode for TCP connections and packets with out of window sequence numbers won t be marked INVALID   p    td    tr   tr  td  code udpTimeout  code   B  Required   B  br    a href  https   pkg go dev k8s io apimachinery pkg apis meta v1 Duration   code meta v1 Duration  code   a    td   td      p udpTimeout is how long an idle UDP conntrack entry in UNREPLIED state will remain in the conntrack table  e g   30s    Must be greater than 0 to set   p    td    tr   tr  td  code udpStreamTimeout  code   B  Required   B  br    a href  https   pkg go dev k8s io apimachinery pkg apis meta v1 Duration   code meta v1 Duration  code   a    td   td      p udpStreamTimeout is how long an idle UDP conntrack entry in ASSURED state will remain in the conntrack table  e g   300s    Must be greater than 0 to set   p    td    tr    tbody    table       KubeProxyIPTablesConfiguration        kubeproxy config k8s io v1alpha1 KubeProxyIPTablesConfiguration          Appears in        KubeProxyConfiguration   kubeproxy config k8s io v1alpha1 KubeProxyConfiguration     p KubeProxyIPTablesConfiguration contains iptables related configuration details for the Kubernetes proxy server   p     table class  table    thead  tr  th width  30   Field  th  th Description  th   tr   thead   tbody           tr  td  code masqueradeBit  code   B  Required   B  br    code int32  code    td   td      p masqueradeBit is the bit of the iptables fwmark space to use for SNAT if using the iptables or ipvs proxy mode  Values must be within the range  0  31    p    td    tr   tr  td  code masqueradeAll  code   B  Required   B  br    code bool  code    td   td      p masqueradeAll tells kube proxy to SNAT all traffic sent to Service cluster IPs  when using the iptables or ipvs proxy mode  This may be required with some CNI plugins   p    td    tr   tr  td  code localhostNodePorts  code   B  Required   B  br    code bool  code    td   td      p localhostNodePorts  if false  tells kube proxy to disable the legacy behavior of allowing NodePort services to be accessed via localhost   Applies only to iptables mode and IPv4  localhost NodePorts are never allowed with other proxy modes or with IPv6    p    td    tr   tr  td  code syncPeriod  code   B  Required   B  br    a href  https   pkg go dev k8s io apimachinery pkg apis meta v1 Duration   code meta v1 Duration  code   a    td   td      p syncPeriod is an interval  e g   5s    1m    2h22m   indicating how frequently various re synchronizing and cleanup operations are performed  Must be greater than 0   p    td    tr   tr  td  code minSyncPeriod  code   B  Required   B  br    a href  https   pkg go dev k8s io apimachinery pkg apis meta v1 Duration   code meta v1 Duration  code   a    td   td      p minSyncPeriod is the minimum period between iptables rule resyncs  e g   5s    1m    2h22m    A value of 0 means every Service or EndpointSlice change will result in an immediate iptables resync   p    td    tr    tbody    table       KubeProxyIPVSConfiguration        kubeproxy config k8s io v1alpha1 KubeProxyIPVSConfiguration          Appears in        KubeProxyConfiguration   kubeproxy config k8s io v1alpha1 KubeProxyConfiguration     p KubeProxyIPVSConfiguration contains ipvs related configuration details for the Kubernetes proxy server   p     table class  table    thead  tr  th width  30   Field  th  th Description  th   tr   thead   tbody           tr  td  code syncPeriod  code   B  Required   B  br    a href  https   pkg go dev k8s io apimachinery pkg apis meta v1 Duration   code meta v1 Duration  code   a    td   td      p syncPeriod is an interval  e g   5s    1m    2h22m   indicating how frequently various re synchronizing and cleanup operations are performed  Must be greater than 0   p    td    tr   tr  td  code minSyncPeriod  code   B  Required   B  br    a href  https   pkg go dev k8s io apimachinery pkg apis meta v1 Duration   code meta v1 Duration  code   a    td   td      p minSyncPeriod is the minimum period between IPVS rule resyncs  e g   5s    1m    2h22m    A value of 0 means every Service or EndpointSlice change will result in an immediate IPVS resync   p    td    tr   tr  td  code scheduler  code   B  Required   B  br    code string  code    td   td      p scheduler is the IPVS scheduler to use  p    td    tr   tr  td  code excludeCIDRs  code   B  Required   B  br    code   string  code    td   td      p excludeCIDRs is a list of CIDRs which the ipvs proxier should not touch when cleaning up ipvs services   p    td    tr   tr  td  code strictARP  code   B  Required   B  br    code bool  code    td   td      p strictARP configures arp ignore and arp announce to avoid answering ARP queries from kube ipvs0 interface  p    td    tr   tr  td  code tcpTimeout  code   B  Required   B  br    a href  https   pkg go dev k8s io apimachinery pkg apis meta v1 Duration   code meta v1 Duration  code   a    td   td      p tcpTimeout is the timeout value used for idle IPVS TCP sessions  The default value is 0  which preserves the current timeout value on the system   p    td    tr   tr  td  code tcpFinTimeout  code   B  Required   B  br    a href  https   pkg go dev k8s io apimachinery pkg apis meta v1 Duration   code meta v1 Duration  code   a    td   td      p tcpFinTimeout is the timeout value used for IPVS TCP sessions after receiving a FIN  The default value is 0  which preserves the current timeout value on the system   p    td    tr   tr  td  code udpTimeout  code   B  Required   B  br    a href  https   pkg go dev k8s io apimachinery pkg apis meta v1 Duration   code meta v1 Duration  code   a    td   td      p udpTimeout is the timeout value used for IPVS UDP packets  The default value is 0  which preserves the current timeout value on the system   p    td    tr    tbody    table       KubeProxyNFTablesConfiguration        kubeproxy config k8s io v1alpha1 KubeProxyNFTablesConfiguration          Appears in        KubeProxyConfiguration   kubeproxy config k8s io v1alpha1 KubeProxyConfiguration     p KubeProxyNFTablesConfiguration contains nftables related configuration details for the Kubernetes proxy server   p     table class  table    thead  tr  th width  30   Field  th  th Description  th   tr   thead   tbody           tr  td  code masqueradeBit  code   B  Required   B  br    code int32  code    td   td      p masqueradeBit is the bit of the iptables fwmark space to use for SNAT if using the nftables proxy mode  Values must be within the range  0  31    p    td    tr   tr  td  code masqueradeAll  code   B  Required   B  br    code bool  code    td   td      p masqueradeAll tells kube proxy to SNAT all traffic sent to Service cluster IPs  when using the nftables mode  This may be required with some CNI plugins   p    td    tr   tr  td  code syncPeriod  code   B  Required   B  br    a href  https   pkg go dev k8s io apimachinery pkg apis meta v1 Duration   code meta v1 Duration  code   a    td   td      p syncPeriod is an interval  e g   5s    1m    2h22m   indicating how frequently various re synchronizing and cleanup operations are performed  Must be greater than 0   p    td    tr   tr  td  code minSyncPeriod  code   B  Required   B  br    a href  https   pkg go dev k8s io apimachinery pkg apis meta v1 Duration   code meta v1 Duration  code   a    td   td      p minSyncPeriod is the minimum period between iptables rule resyncs  e g   5s    1m    2h22m    A value of 0 means every Service or EndpointSlice change will result in an immediate iptables resync   p    td    tr    tbody    table       KubeProxyWinkernelConfiguration        kubeproxy config k8s io v1alpha1 KubeProxyWinkernelConfiguration          Appears in        KubeProxyConfiguration   kubeproxy config k8s io v1alpha1 KubeProxyConfiguration     p KubeProxyWinkernelConfiguration contains Windows HNS settings for the Kubernetes proxy server   p     table class  table    thead  tr  th width  30   Field  th  th Description  th   tr   thead   tbody           tr  td  code networkName  code   B  Required   B  br    code string  code    td   td      p networkName is the name of the network kube proxy will use to create endpoints and policies  p    td    tr   tr  td  code sourceVip  code   B  Required   B  br    code string  code    td   td      p sourceVip is the IP address of the source VIP endpoint used for NAT when loadbalancing  p    td    tr   tr  td  code enableDSR  code   B  Required   B  br    code bool  code    td   td      p enableDSR tells kube proxy whether HNS policies should be created with DSR  p    td    tr   tr  td  code rootHnsEndpointName  code   B  Required   B  br    code string  code    td   td      p rootHnsEndpointName is the name of hnsendpoint that is attached to l2bridge for root network namespace  p    td    tr   tr  td  code forwardHealthCheckVip  code   B  Required   B  br    code bool  code    td   td      p forwardHealthCheckVip forwards service VIP for health check port on Windows  p    td    tr    tbody    table       LocalMode        kubeproxy config k8s io v1alpha1 LocalMode        Alias of  string      Appears in        KubeProxyConfiguration   kubeproxy config k8s io v1alpha1 KubeProxyConfiguration     p LocalMode represents modes to detect local traffic from the node  p          ProxyMode        kubeproxy config k8s io v1alpha1 ProxyMode        Alias of  string      Appears in        KubeProxyConfiguration   kubeproxy config k8s io v1alpha1 KubeProxyConfiguration     p ProxyMode represents modes used by the Kubernetes proxy server   p   p Currently  two modes of proxy are available on Linux platforms   iptables  and  ipvs   One mode of proxy is available on Windows platforms   kernelspace    p   p If the proxy mode is unspecified  the best available proxy mode will be used  currently this is  code iptables  code  on Linux and  code kernelspace  code  on Windows   If the selected proxy mode cannot be used  due to lack of kernel support  missing userspace components  etc  then kube proxy will exit with an error   p


kubernetes reference package admission k8s io v1 contenttype tool reference title kube apiserver Admission v1 Resource Types autogenerated true

Answer:
---
title: kube-apiserver Admission (v1)
content_type: tool-reference
package: admission.k8s.io/v1
auto_generated: true
---

## Resource Types

- [AdmissionReview](#admission-k8s-io-v1-AdmissionReview)

## `AdmissionReview`     {#admission-k8s-io-v1-AdmissionReview}

AdmissionReview describes an admission review request/response.

Field	Description

apiVersion
string	admission.k8s.io/v1

kind
string	AdmissionReview

request

AdmissionRequest

Request describes the attributes for the admission request.

response

AdmissionResponse

Response describes the attributes for the admission response.

## `AdmissionRequest`     {#admission-k8s-io-v1-AdmissionRequest}

**Appears in:**

- [AdmissionReview](#admission-k8s-io-v1-AdmissionReview)

AdmissionRequest describes the admission.Attributes for the admission request.

Field	Description

uid [Required]

k8s.io/apimachinery/pkg/types.UID

UID is an identifier for the individual request/response. It allows us to distinguish instances of requests which are
otherwise identical (parallel requests, requests when earlier requests did not modify etc)
The UID is meant to track the round trip (request/response) between the KAS and the WebHook, not the user request.
It is suitable for correlating log entries between the webhook and apiserver, for either auditing or debugging.

kind [Required]

meta/v1.GroupVersionKind

Kind is the fully-qualified type of object being submitted (for example, v1.Pod or autoscaling.v1.Scale)

resource [Required]

meta/v1.GroupVersionResource

Resource is the fully-qualified resource being requested (for example, v1.pods)

subResource

string

SubResource is the subresource being requested, if any (for example, "status" or "scale")

requestKind

meta/v1.GroupVersionKind

RequestKind is the fully-qualified type of the original API request (for example, v1.Pod or autoscaling.v1.Scale).
If this is specified and differs from the value in "kind", an equivalent match and conversion was performed.

For example, if deployments can be modified via apps/v1 and apps/v1beta1, and a webhook registered a rule of
apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"] and matchPolicy: Equivalent,
an API request to apps/v1beta1 deployments would be converted and sent to the webhook
with kind: {group:"apps", version:"v1", kind:"Deployment"} (matching the rule the webhook registered for),
and requestKind: {group:"apps", version:"v1beta1", kind:"Deployment"} (indicating the kind of the original API request).

See documentation for the "matchPolicy" field in the webhook configuration type for more details.

requestResource

meta/v1.GroupVersionResource

RequestResource is the fully-qualified resource of the original API request (for example, v1.pods).
If this is specified and differs from the value in "resource", an equivalent match and conversion was performed.

For example, if deployments can be modified via apps/v1 and apps/v1beta1, and a webhook registered a rule of
apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"] and matchPolicy: Equivalent,
an API request to apps/v1beta1 deployments would be converted and sent to the webhook
with resource: {group:"apps", version:"v1", resource:"deployments"} (matching the resource the webhook registered for),
and requestResource: {group:"apps", version:"v1beta1", resource:"deployments"} (indicating the resource of the original API request).

See documentation for the "matchPolicy" field in the webhook configuration type.

requestSubResource

string

RequestSubResource is the name of the subresource of the original API request, if any (for example, "status" or "scale")
If this is specified and differs from the value in "subResource", an equivalent match and conversion was performed.
See documentation for the "matchPolicy" field in the webhook configuration type.

name

string

Name is the name of the object as presented in the request.  On a CREATE operation, the client may omit name and
rely on the server to generate the name.  If that is the case, this field will contain an empty string.

namespace

string

Namespace is the namespace associated with the request (if any).

operation [Required]

Operation

Operation is the operation being performed. This may be different than the operation
requested. e.g. a patch can result in either a CREATE or UPDATE Operation.

userInfo [Required]

authentication/v1.UserInfo

UserInfo is information about the requesting user

object

k8s.io/apimachinery/pkg/runtime.RawExtension

Object is the object from the incoming request.

oldObject

k8s.io/apimachinery/pkg/runtime.RawExtension

OldObject is the existing object. Only populated for DELETE and UPDATE requests.

dryRun

bool

DryRun indicates that modifications will definitely not be persisted for this request.
Defaults to false.

options

k8s.io/apimachinery/pkg/runtime.RawExtension

Options is the operation option structure of the operation being performed.
e.g. meta.k8s.io/v1.DeleteOptions or meta.k8s.io/v1.CreateOptions. This may be
different than the options the caller provided. e.g. for a patch request the performed
Operation might be a CREATE, in which case the Options will a
meta.k8s.io/v1.CreateOptions even though the caller provided meta.k8s.io/v1.PatchOptions.

## `AdmissionResponse`     {#admission-k8s-io-v1-AdmissionResponse}

**Appears in:**

- [AdmissionReview](#admission-k8s-io-v1-AdmissionReview)

AdmissionResponse describes an admission response.

Field	Description

uid [Required]

k8s.io/apimachinery/pkg/types.UID

UID is an identifier for the individual request/response.
This must be copied over from the corresponding AdmissionRequest.

allowed [Required]

bool

Allowed indicates whether or not the admission request was permitted.

status

meta/v1.Status

Result contains extra details into why an admission request was denied.
This field IS NOT consulted in any way if "Allowed" is "true".

patch

[]byte

The patch body. Currently we only support "JSONPatch" which implements RFC 6902.

patchType

PatchType

The type of Patch. Currently we only allow "JSONPatch".

auditAnnotations

map[string]string

AuditAnnotations is an unstructured key value map set by remote admission controller (e.g. error=image-blacklisted).
MutatingAdmissionWebhook and ValidatingAdmissionWebhook admission controller will prefix the keys with
admission webhook name (e.g. imagepolicy.example.com/error=image-blacklisted). AuditAnnotations will be provided by
the admission webhook to add additional context to the audit log for this request.

warnings

[]string

warnings is a list of warning messages to return to the requesting API client.
Warning messages describe a problem the client making the API request should correct or be aware of.
Limit warnings to 120 characters if possible.
Warnings over 256 characters and large numbers of warnings may be truncated.

## `Operation`     {#admission-k8s-io-v1-Operation}

(Alias of `string`)

**Appears in:**

- [AdmissionRequest](#admission-k8s-io-v1-AdmissionRequest)

Operation is the type of resource operation being checked for admission control

## `PatchType`     {#admission-k8s-io-v1-PatchType}

(Alias of `string`)

**Appears in:**

- [AdmissionResponse](#admission-k8s-io-v1-AdmissionResponse)

PatchType is the type of patch being used to represent the mutated object

title  kube apiserver Admission  v1  content type  tool reference package  admission k8s io v1 auto generated  true          Resource Types       AdmissionReview   admission k8s io v1 AdmissionReview          AdmissionReview        admission k8s io v1 AdmissionReview          p AdmissionReview describes an admission review request response   p     table class  table    thead  tr  th width  30   Field  th  th Description  th   tr   thead   tbody        tr  td  code apiVersion  code  br  string  td  td  code admission k8s io v1  code   td   tr   tr  td  code kind  code  br  string  td  td  code AdmissionReview  code   td   tr           tr  td  code request  code  br    a href   admission k8s io v1 AdmissionRequest   code AdmissionRequest  code   a    td   td      p Request describes the attributes for the admission request   p    td    tr   tr  td  code response  code  br    a href   admission k8s io v1 AdmissionResponse   code AdmissionResponse  code   a    td   td      p Response describes the attributes for the admission response   p    td    tr    tbody    table       AdmissionRequest        admission k8s io v1 AdmissionRequest          Appears in        AdmissionReview   admission k8s io v1 AdmissionReview     p AdmissionRequest describes the admission Attributes for the admission request   p     table class  table    thead  tr  th width  30   Field  th  th Description  th   tr   thead   tbody           tr  td  code uid  code   B  Required   B  br    a href  https   pkg go dev k8s io apimachinery pkg types UID   code k8s io apimachinery pkg types UID  code   a    td   td      p UID is an identifier for the individual request response  It allows us to distinguish instances of requests which are otherwise identical  parallel requests  requests when earlier requests did not modify etc  The UID is meant to track the round trip  request response  between the KAS and the WebHook  not the user request  It is suitable for correlating log entries between the webhook and apiserver  for either auditing or debugging   p    td    tr   tr  td  code kind  code   B  Required   B  br    a href  https   pkg go dev k8s io apimachinery pkg apis meta v1 GroupVersionKind   code meta v1 GroupVersionKind  code   a    td   td      p Kind is the fully qualified type of object being submitted  for example  v1 Pod or autoscaling v1 Scale   p    td    tr   tr  td  code resource  code   B  Required   B  br    a href  https   pkg go dev k8s io apimachinery pkg apis meta v1 GroupVersionResource   code meta v1 GroupVersionResource  code   a    td   td      p Resource is the fully qualified resource being requested  for example  v1 pods   p    td    tr   tr  td  code subResource  code  br    code string  code    td   td      p SubResource is the subresource being requested  if any  for example   quot status quot  or  quot scale quot    p    td    tr   tr  td  code requestKind  code  br    a href  https   pkg go dev k8s io apimachinery pkg apis meta v1 GroupVersionKind   code meta v1 GroupVersionKind  code   a    td   td      p RequestKind is the fully qualified type of the original API request  for example  v1 Pod or autoscaling v1 Scale   If this is specified and differs from the value in  quot kind quot   an equivalent match and conversion was performed   p   p For example  if deployments can be modified via apps v1 and apps v1beta1  and a webhook registered a rule of  code apiGroups   quot apps quot    apiVersions   quot v1 quot    resources    quot deployments quot    code  and  code matchPolicy  Equivalent  code   an API request to apps v1beta1 deployments would be converted and sent to the webhook with  code kind   group  quot apps quot   version  quot v1 quot   kind  quot Deployment quot    code   matching the rule the webhook registered for   and  code requestKind   group  quot apps quot   version  quot v1beta1 quot   kind  quot Deployment quot    code   indicating the kind of the original API request    p   p See documentation for the  quot matchPolicy quot  field in the webhook configuration type for more details   p    td    tr   tr  td  code requestResource  code  br    a href  https   pkg go dev k8s io apimachinery pkg apis meta v1 GroupVersionResource   code meta v1 GroupVersionResource  code   a    td   td      p RequestResource is the fully qualified resource of the original API request  for example  v1 pods   If this is specified and differs from the value in  quot resource quot   an equivalent match and conversion was performed   p   p For example  if deployments can be modified via apps v1 and apps v1beta1  and a webhook registered a rule of  code apiGroups   quot apps quot    apiVersions   quot v1 quot    resources    quot deployments quot    code  and  code matchPolicy  Equivalent  code   an API request to apps v1beta1 deployments would be converted and sent to the webhook with  code resource   group  quot apps quot   version  quot v1 quot   resource  quot deployments quot    code   matching the resource the webhook registered for   and  code requestResource   group  quot apps quot   version  quot v1beta1 quot   resource  quot deployments quot    code   indicating the resource of the original API request    p   p See documentation for the  quot matchPolicy quot  field in the webhook configuration type   p    td    tr   tr  td  code requestSubResource  code  br    code string  code    td   td      p RequestSubResource is the name of the subresource of the original API request  if any  for example   quot status quot  or  quot scale quot   If this is specified and differs from the value in  quot subResource quot   an equivalent match and conversion was performed  See documentation for the  quot matchPolicy quot  field in the webhook configuration type   p    td    tr   tr  td  code name  code  br    code string  code    td   td      p Name is the name of the object as presented in the request   On a CREATE operation  the client may omit name and rely on the server to generate the name   If that is the case  this field will contain an empty string   p    td    tr   tr  td  code namespace  code  br    code string  code    td   td      p Namespace is the namespace associated with the request  if any    p    td    tr   tr  td  code operation  code   B  Required   B  br    a href   admission k8s io v1 Operation   code Operation  code   a    td   td      p Operation is the operation being performed  This may be different than the operation requested  e g  a patch can result in either a CREATE or UPDATE Operation   p    td    tr   tr  td  code userInfo  code   B  Required   B  br    a href  https   kubernetes io docs reference generated kubernetes api v1 31  userinfo v1 authentication k8s io   code authentication v1 UserInfo  code   a    td   td      p UserInfo is information about the requesting user  p    td    tr   tr  td  code object  code  br    a href  https   pkg go dev k8s io apimachinery pkg runtime  RawExtension   code k8s io apimachinery pkg runtime RawExtension  code   a    td   td      p Object is the object from the incoming request   p    td    tr   tr  td  code oldObject  code  br    a href  https   pkg go dev k8s io apimachinery pkg runtime  RawExtension   code k8s io apimachinery pkg runtime RawExtension  code   a    td   td      p OldObject is the existing object  Only populated for DELETE and UPDATE requests   p    td    tr   tr  td  code dryRun  code  br    code bool  code    td   td      p DryRun indicates that modifications will definitely not be persisted for this request  Defaults to false   p    td    tr   tr  td  code options  code  br    a href  https   pkg go dev k8s io apimachinery pkg runtime  RawExtension   code k8s io apimachinery pkg runtime RawExtension  code   a    td   td      p Options is the operation option structure of the operation being performed  e g   code meta k8s io v1 DeleteOptions  code  or  code meta k8s io v1 CreateOptions  code   This may be different than the options the caller provided  e g  for a patch request the performed Operation might be a CREATE  in which case the Options will a  code meta k8s io v1 CreateOptions  code  even though the caller provided  code meta k8s io v1 PatchOptions  code    p    td    tr    tbody    table       AdmissionResponse        admission k8s io v1 AdmissionResponse          Appears in        AdmissionReview   admission k8s io v1 AdmissionReview     p AdmissionResponse describes an admission response   p     table class  table    thead  tr  th width  30   Field  th  th Description  th   tr   thead   tbody           tr  td  code uid  code   B  Required   B  br    a href  https   pkg go dev k8s io apimachinery pkg types UID   code k8s io apimachinery pkg types UID  code   a    td   td      p UID is an identifier for the individual request response  This must be copied over from the corresponding AdmissionRequest   p    td    tr   tr  td  code allowed  code   B  Required   B  br    code bool  code    td   td      p Allowed indicates whether or not the admission request was permitted   p    td    tr   tr  td  code status  code  br    a href  https   kubernetes io docs reference generated kubernetes api v1 31  status v1 meta   code meta v1 Status  code   a    td   td      p Result contains extra details into why an admission request was denied  This field IS NOT consulted in any way if  quot Allowed quot  is  quot true quot    p    td    tr   tr  td  code patch  code  br    code   byte  code    td   td      p The patch body  Currently we only support  quot JSONPatch quot  which implements RFC 6902   p    td    tr   tr  td  code patchType  code  br    a href   admission k8s io v1 PatchType   code PatchType  code   a    td   td      p The type of Patch  Currently we only allow  quot JSONPatch quot    p    td    tr   tr  td  code auditAnnotations  code  br    code map string string  code    td   td      p AuditAnnotations is an unstructured key value map set by remote admission controller  e g  error image blacklisted   MutatingAdmissionWebhook and ValidatingAdmissionWebhook admission controller will prefix the keys with admission webhook name  e g  imagepolicy example com error image blacklisted   AuditAnnotations will be provided by the admission webhook to add additional context to the audit log for this request   p    td    tr   tr  td  code warnings  code  br    code   string  code    td   td      p warnings is a list of warning messages to return to the requesting API client  Warning messages describe a problem the client making the API request should correct or be aware of  Limit warnings to 120 characters if possible  Warnings over 256 characters and large numbers of warnings may be truncated   p    td    tr    tbody    table       Operation        admission k8s io v1 Operation        Alias of  string      Appears in        AdmissionRequest   admission k8s io v1 AdmissionRequest     p Operation is the type of resource operation being checked for admission control  p          PatchType        admission k8s io v1 PatchType        Alias of  string      Appears in        AdmissionResponse   admission k8s io v1 AdmissionResponse     p PatchType is the type of patch being used to represent the mutated object  p