Skip to content

Commit 7253a86

Browse files
jab-rhjab-rh
authored
Merge pull request #86643 from jab-rh/apis-4-18rc0
Add OpenShift 4.18 RC0 APIs
2 parents a4b092e + b59a005 commit 7253a86

File tree

141 files changed

+24154
-8474
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

141 files changed

+24154
-8474
lines changed

‎api-config.yaml

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -599,12 +599,13 @@ apiMap:
599599
- kind: CatalogSource
600600
group: operators.coreos.com
601601
version: v1alpha1
602+
# ERROR (objects/index.adoc): "xref:../operatorhub_apis/olm-operator-openshift-io-v1.adoc#olm-operator-openshift-io-v1[`array (OLM)`]" appears to try to reference a file not included in the "openshift-enterprise" distro
602603
# - kind: ClusterCatalog
603-
# group: catalogd.operatorframework.io
604-
# version: v1alpha1
604+
# group: olm.operatorframework.io
605+
# version: v1
605606
# - kind: ClusterExtension
606607
# group: olm.operatorframework.io
607-
# version: v1alpha1
608+
# version: v1
608609
- kind: ClusterServiceVersion
609610
group: operators.coreos.com
610611
version: v1alpha1
@@ -613,7 +614,7 @@ apiMap:
613614
version: v1alpha1
614615
# - kind: OLM
615616
# group: operator.openshift.io
616-
# version: v1alpha1
617+
# version: v1
617618
- kind: OLMConfig
618619
group: operators.coreos.com
619620
version: v1

‎rest_api/authorization_apis/localsubjectaccessreview-authorization-k8s-io-v1.adoc

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -150,10 +150,18 @@ Type::
150150
|===
151151
| Property | Type | Description
152152

153+
| `fieldSelector`
154+
| `object`
155+
| FieldSelectorAttributes indicates a field limited access. Webhook authors are encouraged to * ensure rawSelector and requirements are not both set * consider the requirements field if set * not try to parse or consider the rawSelector field if set. This is to avoid another CVE-2022-2880 (i.e. getting different systems to agree on how exactly to parse a query is not something we want), see https://www.oxeye.io/resources/golang-parameter-smuggling-attack for more details. For the *SubjectAccessReview endpoints of the kube-apiserver: * If rawSelector is empty and requirements are empty, the request is not limited. * If rawSelector is present and requirements are empty, the rawSelector will be parsed and limited if the parsing succeeds. * If rawSelector is empty and requirements are present, the requirements should be honored * If rawSelector is present and requirements are present, the request is invalid.
156+
153157
| `group`
154158
| `string`
155159
| Group is the API Group of the Resource. "*" means all.
156160

161+
| `labelSelector`
162+
| `object`
163+
| LabelSelectorAttributes indicates a label limited access. Webhook authors are encouraged to * ensure rawSelector and requirements are not both set * consider the requirements field if set * not try to parse or consider the rawSelector field if set. This is to avoid another CVE-2022-2880 (i.e. getting different systems to agree on how exactly to parse a query is not something we want), see https://www.oxeye.io/resources/golang-parameter-smuggling-attack for more details. For the *SubjectAccessReview endpoints of the kube-apiserver: * If rawSelector is empty and requirements are empty, the request is not limited. * If rawSelector is present and requirements are empty, the rawSelector will be parsed and limited if the parsing succeeds. * If rawSelector is empty and requirements are present, the requirements should be honored * If rawSelector is present and requirements are present, the request is invalid.
164+
157165
| `name`
158166
| `string`
159167
| Name is the name of the resource being requested for a "get" or deleted for a "delete". "" (empty) means all.
@@ -178,6 +186,58 @@ Type::
178186
| `string`
179187
| Version is the API Version of the Resource. "*" means all.
180188

189+
|===
190+
=== .spec.resourceAttributes.fieldSelector
191+
Description::
192+
+
193+
--
194+
FieldSelectorAttributes indicates a field limited access. Webhook authors are encouraged to * ensure rawSelector and requirements are not both set * consider the requirements field if set * not try to parse or consider the rawSelector field if set. This is to avoid another CVE-2022-2880 (i.e. getting different systems to agree on how exactly to parse a query is not something we want), see https://www.oxeye.io/resources/golang-parameter-smuggling-attack for more details. For the *SubjectAccessReview endpoints of the kube-apiserver: * If rawSelector is empty and requirements are empty, the request is not limited. * If rawSelector is present and requirements are empty, the rawSelector will be parsed and limited if the parsing succeeds. * If rawSelector is empty and requirements are present, the requirements should be honored * If rawSelector is present and requirements are present, the request is invalid.
195+
--
196+
197+
Type::
198+
`object`
199+
200+
201+
202+
203+
[cols="1,1,1",options="header"]
204+
|===
205+
| Property | Type | Description
206+
207+
| `rawSelector`
208+
| `string`
209+
| rawSelector is the serialization of a field selector that would be included in a query parameter. Webhook implementations are encouraged to ignore rawSelector. The kube-apiserver's *SubjectAccessReview will parse the rawSelector as long as the requirements are not present.
210+
211+
| `requirements`
212+
| xref:../objects/index.adoc#io-k8s-apimachinery-pkg-apis-meta-v1-FieldSelectorRequirement[`array (FieldSelectorRequirement)`]
213+
| requirements is the parsed interpretation of a field selector. All requirements must be met for a resource instance to match the selector. Webhook implementations should handle requirements, but how to handle them is up to the webhook. Since requirements can only limit the request, it is safe to authorize as unlimited request if the requirements are not understood.
214+
215+
|===
216+
=== .spec.resourceAttributes.labelSelector
217+
Description::
218+
+
219+
--
220+
LabelSelectorAttributes indicates a label limited access. Webhook authors are encouraged to * ensure rawSelector and requirements are not both set * consider the requirements field if set * not try to parse or consider the rawSelector field if set. This is to avoid another CVE-2022-2880 (i.e. getting different systems to agree on how exactly to parse a query is not something we want), see https://www.oxeye.io/resources/golang-parameter-smuggling-attack for more details. For the *SubjectAccessReview endpoints of the kube-apiserver: * If rawSelector is empty and requirements are empty, the request is not limited. * If rawSelector is present and requirements are empty, the rawSelector will be parsed and limited if the parsing succeeds. * If rawSelector is empty and requirements are present, the requirements should be honored * If rawSelector is present and requirements are present, the request is invalid.
221+
--
222+
223+
Type::
224+
`object`
225+
226+
227+
228+
229+
[cols="1,1,1",options="header"]
230+
|===
231+
| Property | Type | Description
232+
233+
| `rawSelector`
234+
| `string`
235+
| rawSelector is the serialization of a field selector that would be included in a query parameter. Webhook implementations are encouraged to ignore rawSelector. The kube-apiserver's *SubjectAccessReview will parse the rawSelector as long as the requirements are not present.
236+
237+
| `requirements`
238+
| xref:../objects/index.adoc#io-k8s-apimachinery-pkg-apis-meta-v1-LabelSelectorRequirement[`array (LabelSelectorRequirement)`]
239+
| requirements is the parsed interpretation of a label selector. All requirements must be met for a resource instance to match the selector. Webhook implementations should handle requirements, but how to handle them is up to the webhook. Since requirements can only limit the request, it is safe to authorize as unlimited request if the requirements are not understood.
240+
181241
|===
182242
=== .status
183243
Description::

‎rest_api/authorization_apis/selfsubjectaccessreview-authorization-k8s-io-v1.adoc

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -117,10 +117,18 @@ Type::
117117
|===
118118
| Property | Type | Description
119119

120+
| `fieldSelector`
121+
| `object`
122+
| FieldSelectorAttributes indicates a field limited access. Webhook authors are encouraged to * ensure rawSelector and requirements are not both set * consider the requirements field if set * not try to parse or consider the rawSelector field if set. This is to avoid another CVE-2022-2880 (i.e. getting different systems to agree on how exactly to parse a query is not something we want), see https://www.oxeye.io/resources/golang-parameter-smuggling-attack for more details. For the *SubjectAccessReview endpoints of the kube-apiserver: * If rawSelector is empty and requirements are empty, the request is not limited. * If rawSelector is present and requirements are empty, the rawSelector will be parsed and limited if the parsing succeeds. * If rawSelector is empty and requirements are present, the requirements should be honored * If rawSelector is present and requirements are present, the request is invalid.
123+
120124
| `group`
121125
| `string`
122126
| Group is the API Group of the Resource. "*" means all.
123127

128+
| `labelSelector`
129+
| `object`
130+
| LabelSelectorAttributes indicates a label limited access. Webhook authors are encouraged to * ensure rawSelector and requirements are not both set * consider the requirements field if set * not try to parse or consider the rawSelector field if set. This is to avoid another CVE-2022-2880 (i.e. getting different systems to agree on how exactly to parse a query is not something we want), see https://www.oxeye.io/resources/golang-parameter-smuggling-attack for more details. For the *SubjectAccessReview endpoints of the kube-apiserver: * If rawSelector is empty and requirements are empty, the request is not limited. * If rawSelector is present and requirements are empty, the rawSelector will be parsed and limited if the parsing succeeds. * If rawSelector is empty and requirements are present, the requirements should be honored * If rawSelector is present and requirements are present, the request is invalid.
131+
124132
| `name`
125133
| `string`
126134
| Name is the name of the resource being requested for a "get" or deleted for a "delete". "" (empty) means all.
@@ -145,6 +153,58 @@ Type::
145153
| `string`
146154
| Version is the API Version of the Resource. "*" means all.
147155

156+
|===
157+
=== .spec.resourceAttributes.fieldSelector
158+
Description::
159+
+
160+
--
161+
FieldSelectorAttributes indicates a field limited access. Webhook authors are encouraged to * ensure rawSelector and requirements are not both set * consider the requirements field if set * not try to parse or consider the rawSelector field if set. This is to avoid another CVE-2022-2880 (i.e. getting different systems to agree on how exactly to parse a query is not something we want), see https://www.oxeye.io/resources/golang-parameter-smuggling-attack for more details. For the *SubjectAccessReview endpoints of the kube-apiserver: * If rawSelector is empty and requirements are empty, the request is not limited. * If rawSelector is present and requirements are empty, the rawSelector will be parsed and limited if the parsing succeeds. * If rawSelector is empty and requirements are present, the requirements should be honored * If rawSelector is present and requirements are present, the request is invalid.
162+
--
163+
164+
Type::
165+
`object`
166+
167+
168+
169+
170+
[cols="1,1,1",options="header"]
171+
|===
172+
| Property | Type | Description
173+
174+
| `rawSelector`
175+
| `string`
176+
| rawSelector is the serialization of a field selector that would be included in a query parameter. Webhook implementations are encouraged to ignore rawSelector. The kube-apiserver's *SubjectAccessReview will parse the rawSelector as long as the requirements are not present.
177+
178+
| `requirements`
179+
| xref:../objects/index.adoc#io-k8s-apimachinery-pkg-apis-meta-v1-FieldSelectorRequirement[`array (FieldSelectorRequirement)`]
180+
| requirements is the parsed interpretation of a field selector. All requirements must be met for a resource instance to match the selector. Webhook implementations should handle requirements, but how to handle them is up to the webhook. Since requirements can only limit the request, it is safe to authorize as unlimited request if the requirements are not understood.
181+
182+
|===
183+
=== .spec.resourceAttributes.labelSelector
184+
Description::
185+
+
186+
--
187+
LabelSelectorAttributes indicates a label limited access. Webhook authors are encouraged to * ensure rawSelector and requirements are not both set * consider the requirements field if set * not try to parse or consider the rawSelector field if set. This is to avoid another CVE-2022-2880 (i.e. getting different systems to agree on how exactly to parse a query is not something we want), see https://www.oxeye.io/resources/golang-parameter-smuggling-attack for more details. For the *SubjectAccessReview endpoints of the kube-apiserver: * If rawSelector is empty and requirements are empty, the request is not limited. * If rawSelector is present and requirements are empty, the rawSelector will be parsed and limited if the parsing succeeds. * If rawSelector is empty and requirements are present, the requirements should be honored * If rawSelector is present and requirements are present, the request is invalid.
188+
--
189+
190+
Type::
191+
`object`
192+
193+
194+
195+
196+
[cols="1,1,1",options="header"]
197+
|===
198+
| Property | Type | Description
199+
200+
| `rawSelector`
201+
| `string`
202+
| rawSelector is the serialization of a field selector that would be included in a query parameter. Webhook implementations are encouraged to ignore rawSelector. The kube-apiserver's *SubjectAccessReview will parse the rawSelector as long as the requirements are not present.
203+
204+
| `requirements`
205+
| xref:../objects/index.adoc#io-k8s-apimachinery-pkg-apis-meta-v1-LabelSelectorRequirement[`array (LabelSelectorRequirement)`]
206+
| requirements is the parsed interpretation of a label selector. All requirements must be met for a resource instance to match the selector. Webhook implementations should handle requirements, but how to handle them is up to the webhook. Since requirements can only limit the request, it is safe to authorize as unlimited request if the requirements are not understood.
207+
148208
|===
149209
=== .status
150210
Description::

‎rest_api/authorization_apis/subjectaccessreview-authorization-k8s-io-v1.adoc

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -150,10 +150,18 @@ Type::
150150
|===
151151
| Property | Type | Description
152152

153+
| `fieldSelector`
154+
| `object`
155+
| FieldSelectorAttributes indicates a field limited access. Webhook authors are encouraged to * ensure rawSelector and requirements are not both set * consider the requirements field if set * not try to parse or consider the rawSelector field if set. This is to avoid another CVE-2022-2880 (i.e. getting different systems to agree on how exactly to parse a query is not something we want), see https://www.oxeye.io/resources/golang-parameter-smuggling-attack for more details. For the *SubjectAccessReview endpoints of the kube-apiserver: * If rawSelector is empty and requirements are empty, the request is not limited. * If rawSelector is present and requirements are empty, the rawSelector will be parsed and limited if the parsing succeeds. * If rawSelector is empty and requirements are present, the requirements should be honored * If rawSelector is present and requirements are present, the request is invalid.
156+
153157
| `group`
154158
| `string`
155159
| Group is the API Group of the Resource. "*" means all.
156160

161+
| `labelSelector`
162+
| `object`
163+
| LabelSelectorAttributes indicates a label limited access. Webhook authors are encouraged to * ensure rawSelector and requirements are not both set * consider the requirements field if set * not try to parse or consider the rawSelector field if set. This is to avoid another CVE-2022-2880 (i.e. getting different systems to agree on how exactly to parse a query is not something we want), see https://www.oxeye.io/resources/golang-parameter-smuggling-attack for more details. For the *SubjectAccessReview endpoints of the kube-apiserver: * If rawSelector is empty and requirements are empty, the request is not limited. * If rawSelector is present and requirements are empty, the rawSelector will be parsed and limited if the parsing succeeds. * If rawSelector is empty and requirements are present, the requirements should be honored * If rawSelector is present and requirements are present, the request is invalid.
164+
157165
| `name`
158166
| `string`
159167
| Name is the name of the resource being requested for a "get" or deleted for a "delete". "" (empty) means all.
@@ -178,6 +186,58 @@ Type::
178186
| `string`
179187
| Version is the API Version of the Resource. "*" means all.
180188

189+
|===
190+
=== .spec.resourceAttributes.fieldSelector
191+
Description::
192+
+
193+
--
194+
FieldSelectorAttributes indicates a field limited access. Webhook authors are encouraged to * ensure rawSelector and requirements are not both set * consider the requirements field if set * not try to parse or consider the rawSelector field if set. This is to avoid another CVE-2022-2880 (i.e. getting different systems to agree on how exactly to parse a query is not something we want), see https://www.oxeye.io/resources/golang-parameter-smuggling-attack for more details. For the *SubjectAccessReview endpoints of the kube-apiserver: * If rawSelector is empty and requirements are empty, the request is not limited. * If rawSelector is present and requirements are empty, the rawSelector will be parsed and limited if the parsing succeeds. * If rawSelector is empty and requirements are present, the requirements should be honored * If rawSelector is present and requirements are present, the request is invalid.
195+
--
196+
197+
Type::
198+
`object`
199+
200+
201+
202+
203+
[cols="1,1,1",options="header"]
204+
|===
205+
| Property | Type | Description
206+
207+
| `rawSelector`
208+
| `string`
209+
| rawSelector is the serialization of a field selector that would be included in a query parameter. Webhook implementations are encouraged to ignore rawSelector. The kube-apiserver's *SubjectAccessReview will parse the rawSelector as long as the requirements are not present.
210+
211+
| `requirements`
212+
| xref:../objects/index.adoc#io-k8s-apimachinery-pkg-apis-meta-v1-FieldSelectorRequirement[`array (FieldSelectorRequirement)`]
213+
| requirements is the parsed interpretation of a field selector. All requirements must be met for a resource instance to match the selector. Webhook implementations should handle requirements, but how to handle them is up to the webhook. Since requirements can only limit the request, it is safe to authorize as unlimited request if the requirements are not understood.
214+
215+
|===
216+
=== .spec.resourceAttributes.labelSelector
217+
Description::
218+
+
219+
--
220+
LabelSelectorAttributes indicates a label limited access. Webhook authors are encouraged to * ensure rawSelector and requirements are not both set * consider the requirements field if set * not try to parse or consider the rawSelector field if set. This is to avoid another CVE-2022-2880 (i.e. getting different systems to agree on how exactly to parse a query is not something we want), see https://www.oxeye.io/resources/golang-parameter-smuggling-attack for more details. For the *SubjectAccessReview endpoints of the kube-apiserver: * If rawSelector is empty and requirements are empty, the request is not limited. * If rawSelector is present and requirements are empty, the rawSelector will be parsed and limited if the parsing succeeds. * If rawSelector is empty and requirements are present, the requirements should be honored * If rawSelector is present and requirements are present, the request is invalid.
221+
--
222+
223+
Type::
224+
`object`
225+
226+
227+
228+
229+
[cols="1,1,1",options="header"]
230+
|===
231+
| Property | Type | Description
232+
233+
| `rawSelector`
234+
| `string`
235+
| rawSelector is the serialization of a field selector that would be included in a query parameter. Webhook implementations are encouraged to ignore rawSelector. The kube-apiserver's *SubjectAccessReview will parse the rawSelector as long as the requirements are not present.
236+
237+
| `requirements`
238+
| xref:../objects/index.adoc#io-k8s-apimachinery-pkg-apis-meta-v1-LabelSelectorRequirement[`array (LabelSelectorRequirement)`]
239+
| requirements is the parsed interpretation of a label selector. All requirements must be met for a resource instance to match the selector. Webhook implementations should handle requirements, but how to handle them is up to the webhook. Since requirements can only limit the request, it is safe to authorize as unlimited request if the requirements are not understood.
240+
181241
|===
182242
=== .status
183243
Description::

0 commit comments

Comments
 (0)