auditregistration

type AuditSink struct {
	metav1.TypeMeta

	// +optional
	metav1.ObjectMeta

	// Spec defines the audit sink spec
	Spec AuditSinkSpec
}

type AuditSinkList struct {
	metav1.TypeMeta

	// +optional
	metav1.ListMeta

	// List of audit configurations.
	Items []AuditSink
}

type AuditSinkSpec struct {
	// Policy defines the policy for selecting which events should be sent to the backend
	// required
	Policy Policy

	// Webhook to send events
	// required
	Webhook Webhook
}

type Level string

type Policy struct {
	// The Level that all requests are recorded at.
	// available options: None, Metadata, Request, RequestResponse
	// required
	Level Level

	// Stages is a list of stages for which events are created.
	// +optional
	Stages []Stage
}

type ServiceReference struct {
	// `namespace` is the namespace of the service.
	// Required
	Namespace string

	// `name` is the name of the service.
	// Required
	Name string

	// `path` is an optional URL path which will be sent in any request to
	// this service.
	// +optional
	Path *string
}

type Stage string

type Webhook struct {
	// Throttle holds the options for throttling the webhook
	// +optional
	Throttle *WebhookThrottleConfig

	// ClientConfig holds the connection parameters for the webhook
	// required
	ClientConfig WebhookClientConfig
}

type WebhookClientConfig struct {
	// `url` gives the location of the webhook, in standard URL form
	// (`scheme://host:port/path`). Exactly one of `url` or `service`
	// must be specified.
	//
	// The `host` should not refer to a service running in the cluster; use
	// the `service` field instead. The host might be resolved via external
	// DNS in some apiservers (e.g., `kube-apiserver` cannot resolve
	// in-cluster DNS as that would be a layering violation). `host` may
	// also be an IP address.
	//
	// Please note that using `localhost` or `127.0.0.1` as a `host` is
	// risky unless you take great care to run this webhook on all hosts
	// which run an apiserver which might need to make calls to this
	// webhook. Such installs are likely to be non-portable, i.e., not easy
	// to turn up in a new cluster.
	//
	// The scheme must be "https"; the URL must begin with "https://".
	//
	// A path is optional, and if present may be any string permissible in
	// a URL. You may use the path to pass an arbitrary string to the
	// webhook, for example, a cluster identifier.
	//
	// Attempting to use a user or basic auth e.g. "user:password@" is not
	// allowed. Fragments ("#...") and query parameters ("?...") are not
	// allowed, either.
	//
	// +optional
	URL *string

	// `service` is a reference to the service for this webhook. Either
	// `service` or `url` must be specified.
	//
	// If the webhook is running within the cluster, then you should use `service`.
	//
	// Port 443 will be used if it is open, otherwise it is an error.
	//
	// +optional
	Service *ServiceReference

	// `caBundle` is a PEM encoded CA bundle which will be used to validate the webhook's server certificate.
	// If unspecified, system trust roots on the apiserver are used.
	// +optional
	CABundle []byte
}

type WebhookThrottleConfig struct {
	// QPS maximum number of batches per second
	// default 10 QPS
	// +optional
	QPS *int64

	// Burst is the maximum number of events sent at the same moment
	// default 15 QPS
	// +optional
	Burst *int64
}