const isNegativeErrorMsg … const isInvalidQuotaResource … const fieldImmutableErrorMsg … const isNotIntegerErrorMsg … const isNotPositiveErrorMsg … var pdPartitionErrorMsg … var fileModeErrorMsg … var BannedOwners … var iscsiInitiatorIqnRegex … var iscsiInitiatorEuiRegex … var iscsiInitiatorNaaRegex … var allowedEphemeralContainerFields … var validOS … // ValidateHasLabel requires that metav1.ObjectMeta has a Label with key and expectedValue func ValidateHasLabel(meta metav1.ObjectMeta, fldPath *field.Path, key, expectedValue string) field.ErrorList { … } // ValidateAnnotations validates that a set of annotations are correctly defined. func ValidateAnnotations(annotations map[string]string, fldPath *field.Path) field.ErrorList { … } func ValidateDNS1123Label(value string, fldPath *field.Path) field.ErrorList { … } // ValidateQualifiedName validates if name is what Kubernetes calls a "qualified name". func ValidateQualifiedName(value string, fldPath *field.Path) field.ErrorList { … } // ValidateDNS1123SubdomainWithUnderScore validates that a name is a proper DNS subdomain but allows for an underscore in the string func ValidateDNS1123SubdomainWithUnderScore(value string, fldPath *field.Path) field.ErrorList { … } // ValidateDNS1123Subdomain validates that a name is a proper DNS subdomain. func ValidateDNS1123Subdomain(value string, fldPath *field.Path) field.ErrorList { … } func ValidatePodSpecificAnnotations(annotations map[string]string, spec *core.PodSpec, fldPath *field.Path, opts PodValidationOptions) field.ErrorList { … } // ValidateTolerationsInPodAnnotations tests that the serialized tolerations in Pod.Annotations has valid data func ValidateTolerationsInPodAnnotations(annotations map[string]string, fldPath *field.Path) field.ErrorList { … } func ValidatePodSpecificAnnotationUpdates(newPod, oldPod *core.Pod, fldPath *field.Path, opts PodValidationOptions) field.ErrorList { … } func ValidateEndpointsSpecificAnnotations(annotations map[string]string, fldPath *field.Path) field.ErrorList { … } type ValidateNameFunc … var ValidatePodName … var ValidateReplicationControllerName … var ValidateServiceName … var ValidateNodeName … var ValidateNamespaceName … var ValidateLimitRangeName … var ValidateResourceQuotaName … var ValidateSecretName … var ValidateServiceAccountName … var ValidateEndpointsName … var ValidateClassName … var ValidatePriorityClassName … var ValidateResourceClaimName … var ValidateResourceClaimTemplateName … // ValidateRuntimeClassName can be used to check whether the given RuntimeClass name is valid. // Prefix indicates this name will be used as part of generation, in which case // trailing dashes are allowed. func ValidateRuntimeClassName(name string, fldPath *field.Path) field.ErrorList { … } // validateOverhead can be used to check whether the given Overhead is valid. func validateOverhead(overhead core.ResourceList, fldPath *field.Path, opts PodValidationOptions) field.ErrorList { … } // Validates that given value is not negative. func ValidateNonnegativeField(value int64, fldPath *field.Path) field.ErrorList { … } // Validates that a Quantity is not negative func ValidateNonnegativeQuantity(value resource.Quantity, fldPath *field.Path) field.ErrorList { … } // Validates that a Quantity is positive func ValidatePositiveQuantityValue(value resource.Quantity, fldPath *field.Path) field.ErrorList { … } func ValidateImmutableField(newVal, oldVal interface{ … } func ValidateImmutableAnnotation(newVal string, oldVal string, annotation string, fldPath *field.Path) field.ErrorList { … } // ValidateObjectMeta validates an object's metadata on creation. It expects that name generation has already // been performed. // It doesn't return an error for rootscoped resources with namespace, because namespace should already be cleared before. // TODO: Remove calls to this method scattered in validations of specific resources, e.g., ValidatePodUpdate. func ValidateObjectMeta(meta *metav1.ObjectMeta, requiresNamespace bool, nameFn ValidateNameFunc, fldPath *field.Path) field.ErrorList { … } // ValidateObjectMetaUpdate validates an object's metadata when updated func ValidateObjectMetaUpdate(newMeta, oldMeta *metav1.ObjectMeta, fldPath *field.Path) field.ErrorList { … } func ValidateVolumes(volumes []core.Volume, podMeta *metav1.ObjectMeta, fldPath *field.Path, opts PodValidationOptions) (map[string]core.VolumeSource, field.ErrorList) { … } func IsMatchedVolume(name string, volumes map[string]core.VolumeSource) bool { … } // isMatched checks whether the volume with the given name is used by a // container and if so, if it involves a PVC. func isMatchedDevice(name string, volumes map[string]core.VolumeSource) (isMatched bool, isPVC bool) { … } func mountNameAlreadyExists(name string, devices map[string]string) bool { … } func mountPathAlreadyExists(mountPath string, devices map[string]string) bool { … } func deviceNameAlreadyExists(name string, mounts map[string]string) bool { … } func devicePathAlreadyExists(devicePath string, mounts map[string]string) bool { … } func validateVolumeSource(source *core.VolumeSource, fldPath *field.Path, volName string, podMeta *metav1.ObjectMeta, opts PodValidationOptions) field.ErrorList { … } func validateHostPathVolumeSource(hostPath *core.HostPathVolumeSource, fldPath *field.Path) field.ErrorList { … } func validateGitRepoVolumeSource(gitRepo *core.GitRepoVolumeSource, fldPath *field.Path) field.ErrorList { … } func validateISCSIVolumeSource(iscsi *core.ISCSIVolumeSource, fldPath *field.Path) field.ErrorList { … } func validateISCSIPersistentVolumeSource(iscsi *core.ISCSIPersistentVolumeSource, pvName string, fldPath *field.Path) field.ErrorList { … } func validateFCVolumeSource(fc *core.FCVolumeSource, fldPath *field.Path) field.ErrorList { … } func validateGCEPersistentDiskVolumeSource(pd *core.GCEPersistentDiskVolumeSource, fldPath *field.Path) field.ErrorList { … } func validateAWSElasticBlockStoreVolumeSource(PD *core.AWSElasticBlockStoreVolumeSource, fldPath *field.Path) field.ErrorList { … } func validateSecretVolumeSource(secretSource *core.SecretVolumeSource, fldPath *field.Path) field.ErrorList { … } func validateConfigMapVolumeSource(configMapSource *core.ConfigMapVolumeSource, fldPath *field.Path) field.ErrorList { … } func validateKeyToPath(kp *core.KeyToPath, fldPath *field.Path) field.ErrorList { … } func validatePersistentClaimVolumeSource(claim *core.PersistentVolumeClaimVolumeSource, fldPath *field.Path) field.ErrorList { … } func validateNFSVolumeSource(nfs *core.NFSVolumeSource, fldPath *field.Path) field.ErrorList { … } func validateQuobyteVolumeSource(quobyte *core.QuobyteVolumeSource, fldPath *field.Path) field.ErrorList { … } func validateGlusterfsVolumeSource(glusterfs *core.GlusterfsVolumeSource, fldPath *field.Path) field.ErrorList { … } func validateGlusterfsPersistentVolumeSource(glusterfs *core.GlusterfsPersistentVolumeSource, fldPath *field.Path) field.ErrorList { … } func validateFlockerVolumeSource(flocker *core.FlockerVolumeSource, fldPath *field.Path) field.ErrorList { … } var validVolumeDownwardAPIFieldPathExpressions … func validateDownwardAPIVolumeFile(file *core.DownwardAPIVolumeFile, fldPath *field.Path, opts PodValidationOptions) field.ErrorList { … } func validateDownwardAPIVolumeSource(downwardAPIVolume *core.DownwardAPIVolumeSource, fldPath *field.Path, opts PodValidationOptions) field.ErrorList { … } func validateProjectionSources(projection *core.ProjectedVolumeSource, projectionMode *int32, fldPath *field.Path, opts PodValidationOptions) field.ErrorList { … } func validateProjectedVolumeSource(projection *core.ProjectedVolumeSource, fldPath *field.Path, opts PodValidationOptions) field.ErrorList { … } var supportedHostPathTypes … func validateHostPathType(hostPathType *core.HostPathType, fldPath *field.Path) field.ErrorList { … } // This validate will make sure targetPath: // 1. is not abs path // 2. does not have any element which is ".." func validateLocalDescendingPath(targetPath string, fldPath *field.Path) field.ErrorList { … } // validatePathNoBacksteps makes sure the targetPath does not have any `..` path elements when split // // This assumes the OS of the apiserver and the nodes are the same. The same check should be done // on the node to ensure there are no backsteps. func validatePathNoBacksteps(targetPath string, fldPath *field.Path) field.ErrorList { … } // validateMountPropagation verifies that MountPropagation field is valid and // allowed for given container. func validateMountPropagation(mountPropagation *core.MountPropagationMode, container *core.Container, fldPath *field.Path) field.ErrorList { … } // validateMountRecursiveReadOnly validates RecursiveReadOnly mounts. func validateMountRecursiveReadOnly(mount core.VolumeMount, fldPath *field.Path) field.ErrorList { … } // ValidateLocalNonReservedPath makes sure targetPath: // 1. is not abs path // 2. does not contain any '..' elements // 3. does not start with '..' func ValidateLocalNonReservedPath(targetPath string, fldPath *field.Path) field.ErrorList { … } func validateRBDVolumeSource(rbd *core.RBDVolumeSource, fldPath *field.Path) field.ErrorList { … } func validateRBDPersistentVolumeSource(rbd *core.RBDPersistentVolumeSource, fldPath *field.Path) field.ErrorList { … } func validateCinderVolumeSource(cd *core.CinderVolumeSource, fldPath *field.Path) field.ErrorList { … } func validateCinderPersistentVolumeSource(cd *core.CinderPersistentVolumeSource, fldPath *field.Path) field.ErrorList { … } func validateCephFSVolumeSource(cephfs *core.CephFSVolumeSource, fldPath *field.Path) field.ErrorList { … } func validateCephFSPersistentVolumeSource(cephfs *core.CephFSPersistentVolumeSource, fldPath *field.Path) field.ErrorList { … } func validateFlexVolumeSource(fv *core.FlexVolumeSource, fldPath *field.Path) field.ErrorList { … } func validateFlexPersistentVolumeSource(fv *core.FlexPersistentVolumeSource, fldPath *field.Path) field.ErrorList { … } func validateAzureFile(azure *core.AzureFileVolumeSource, fldPath *field.Path) field.ErrorList { … } func validateAzureFilePV(azure *core.AzureFilePersistentVolumeSource, fldPath *field.Path) field.ErrorList { … } func validateAzureDisk(azure *core.AzureDiskVolumeSource, fldPath *field.Path) field.ErrorList { … } func validateVsphereVolumeSource(cd *core.VsphereVirtualDiskVolumeSource, fldPath *field.Path) field.ErrorList { … } func validatePhotonPersistentDiskVolumeSource(cd *core.PhotonPersistentDiskVolumeSource, fldPath *field.Path) field.ErrorList { … } func validatePortworxVolumeSource(pwx *core.PortworxVolumeSource, fldPath *field.Path) field.ErrorList { … } func validateScaleIOVolumeSource(sio *core.ScaleIOVolumeSource, fldPath *field.Path) field.ErrorList { … } func validateScaleIOPersistentVolumeSource(sio *core.ScaleIOPersistentVolumeSource, fldPath *field.Path) field.ErrorList { … } func validateLocalVolumeSource(ls *core.LocalVolumeSource, fldPath *field.Path) field.ErrorList { … } func validateStorageOSVolumeSource(storageos *core.StorageOSVolumeSource, fldPath *field.Path) field.ErrorList { … } func validateStorageOSPersistentVolumeSource(storageos *core.StorageOSPersistentVolumeSource, fldPath *field.Path) field.ErrorList { … } func validatePVSecretReference(secretRef *core.SecretReference, fldPath *field.Path) field.ErrorList { … } func ValidateCSIDriverName(driverName string, fldPath *field.Path) field.ErrorList { … } func validateCSIPersistentVolumeSource(csi *core.CSIPersistentVolumeSource, fldPath *field.Path) field.ErrorList { … } func validateCSIVolumeSource(csi *core.CSIVolumeSource, fldPath *field.Path) field.ErrorList { … } func validateEphemeralVolumeSource(ephemeral *core.EphemeralVolumeSource, fldPath *field.Path) field.ErrorList { … } // ValidatePersistentVolumeClaimTemplate verifies that the embedded object meta and spec are valid. // Checking of the object data is very minimal because only labels and annotations are used. func ValidatePersistentVolumeClaimTemplate(claimTemplate *core.PersistentVolumeClaimTemplate, fldPath *field.Path, opts PersistentVolumeClaimSpecValidationOptions) field.ErrorList { … } func ValidateTemplateObjectMeta(objMeta *metav1.ObjectMeta, fldPath *field.Path) field.ErrorList { … } var allowedTemplateObjectMetaFields … type PersistentVolumeSpecValidationOptions … var ValidatePersistentVolumeName … var supportedAccessModes … var supportedReclaimPolicy … var supportedVolumeModes … func ValidationOptionsForPersistentVolume(pv, oldPv *core.PersistentVolume) PersistentVolumeSpecValidationOptions { … } func ValidatePersistentVolumeSpec(pvSpec *core.PersistentVolumeSpec, pvName string, validateInlinePersistentVolumeSpec bool, fldPath *field.Path, opts PersistentVolumeSpecValidationOptions) field.ErrorList { … } func ValidatePersistentVolume(pv *core.PersistentVolume, opts PersistentVolumeSpecValidationOptions) field.ErrorList { … } // ValidatePersistentVolumeUpdate tests to see if the update is legal for an end user to make. // newPv is updated with fields that cannot be changed. func ValidatePersistentVolumeUpdate(newPv, oldPv *core.PersistentVolume, opts PersistentVolumeSpecValidationOptions) field.ErrorList { … } // ValidatePersistentVolumeStatusUpdate tests to see if the status update is legal for an end user to make. func ValidatePersistentVolumeStatusUpdate(newPv, oldPv *core.PersistentVolume) field.ErrorList { … } type PersistentVolumeClaimSpecValidationOptions … func ValidationOptionsForPersistentVolumeClaim(pvc, oldPvc *core.PersistentVolumeClaim) PersistentVolumeClaimSpecValidationOptions { … } func ValidationOptionsForPersistentVolumeClaimTemplate(claimTemplate, oldClaimTemplate *core.PersistentVolumeClaimTemplate) PersistentVolumeClaimSpecValidationOptions { … } // allowInvalidAPIGroupInDataSourceOrRef returns true if the spec contains a data source or data source reference with an API group func allowInvalidAPIGroupInDataSourceOrRef(spec *core.PersistentVolumeClaimSpec) bool { … } // ValidatePersistentVolumeClaim validates a PersistentVolumeClaim func ValidatePersistentVolumeClaim(pvc *core.PersistentVolumeClaim, opts PersistentVolumeClaimSpecValidationOptions) field.ErrorList { … } // validateDataSource validates a DataSource/DataSourceRef in a PersistentVolumeClaimSpec func validateDataSource(dataSource *core.TypedLocalObjectReference, fldPath *field.Path, allowInvalidAPIGroupInDataSourceOrRef bool) field.ErrorList { … } // validateDataSourceRef validates a DataSourceRef in a PersistentVolumeClaimSpec func validateDataSourceRef(dataSourceRef *core.TypedObjectReference, fldPath *field.Path, allowInvalidAPIGroupInDataSourceOrRef bool) field.ErrorList { … } // ValidatePersistentVolumeClaimSpec validates a PersistentVolumeClaimSpec func ValidatePersistentVolumeClaimSpec(spec *core.PersistentVolumeClaimSpec, fldPath *field.Path, opts PersistentVolumeClaimSpecValidationOptions) field.ErrorList { … } func isDataSourceEqualDataSourceRef(dataSource *core.TypedLocalObjectReference, dataSourceRef *core.TypedObjectReference) bool { … } // ValidatePersistentVolumeClaimUpdate validates an update to a PersistentVolumeClaim func ValidatePersistentVolumeClaimUpdate(newPvc, oldPvc *core.PersistentVolumeClaim, opts PersistentVolumeClaimSpecValidationOptions) field.ErrorList { … } // Provide an upgrade path from PVC with storage class specified in beta // annotation to storage class specified in attribute. We allow update of // StorageClassName only if following four conditions are met at the same time: // 1. The old pvc's StorageClassAnnotation is set // 2. The old pvc's StorageClassName is not set // 3. The new pvc's StorageClassName is set and equal to the old value in annotation // 4. If the new pvc's StorageClassAnnotation is set,it must be equal to the old pv/pvc's StorageClassAnnotation func validateStorageClassUpgradeFromAnnotation(oldAnnotations, newAnnotations map[string]string, oldScName, newScName *string) bool { … } // Provide an upgrade path from PVC with nil storage class. We allow update of // StorageClassName only if following four conditions are met at the same time: // 1. The new pvc's StorageClassName is not nil // 2. The old pvc's StorageClassName is nil // 3. The old pvc either does not have beta annotation set, or the beta annotation matches new pvc's StorageClassName func validateStorageClassUpgradeFromNil(oldAnnotations map[string]string, oldScName, newScName *string, opts PersistentVolumeClaimSpecValidationOptions) bool { … } func validatePersistentVolumeClaimResourceKey(value string, fldPath *field.Path) field.ErrorList { … } var resizeStatusSet … // ValidatePersistentVolumeClaimStatusUpdate validates an update to status of a PersistentVolumeClaim func ValidatePersistentVolumeClaimStatusUpdate(newPvc, oldPvc *core.PersistentVolumeClaim, validationOpts PersistentVolumeClaimSpecValidationOptions) field.ErrorList { … } var supportedPortProtocols … func validateContainerPorts(ports []core.ContainerPort, fldPath *field.Path) field.ErrorList { … } // ValidateEnv validates env vars func ValidateEnv(vars []core.EnvVar, fldPath *field.Path, opts PodValidationOptions) field.ErrorList { … } var validEnvDownwardAPIFieldPathExpressions … var validContainerResourceFieldPathExpressions … var validContainerResourceFieldPathPrefixesWithDownwardAPIHugePages … const hugepagesRequestsPrefixDownwardAPI … const hugepagesLimitsPrefixDownwardAPI … func validateEnvVarValueFrom(ev core.EnvVar, fldPath *field.Path, opts PodValidationOptions) field.ErrorList { … } func validateObjectFieldSelector(fs *core.ObjectFieldSelector, expressions *sets.Set[string], fldPath *field.Path) field.ErrorList { … } func validateDownwardAPIHostIPs(fieldSel *core.ObjectFieldSelector, fldPath *field.Path, opts PodValidationOptions) field.ErrorList { … } func validateContainerResourceFieldSelector(fs *core.ResourceFieldSelector, expressions *sets.Set[string], prefixes *sets.Set[string], fldPath *field.Path, volume bool) field.ErrorList { … } func ValidateEnvFrom(vars []core.EnvFromSource, fldPath *field.Path, opts PodValidationOptions) field.ErrorList { … } func validateConfigMapEnvSource(configMapSource *core.ConfigMapEnvSource, fldPath *field.Path) field.ErrorList { … } func validateSecretEnvSource(secretSource *core.SecretEnvSource, fldPath *field.Path) field.ErrorList { … } var validContainerResourceDivisorForCPU … var validContainerResourceDivisorForMemory … var validContainerResourceDivisorForHugePages … var validContainerResourceDivisorForEphemeralStorage … func validateContainerResourceDivisor(rName string, divisor resource.Quantity, fldPath *field.Path) field.ErrorList { … } func validateConfigMapKeySelector(s *core.ConfigMapKeySelector, fldPath *field.Path) field.ErrorList { … } func validateSecretKeySelector(s *core.SecretKeySelector, fldPath *field.Path) field.ErrorList { … } func GetVolumeMountMap(mounts []core.VolumeMount) map[string]string { … } func GetVolumeDeviceMap(devices []core.VolumeDevice) map[string]string { … } func ValidateVolumeMounts(mounts []core.VolumeMount, voldevices map[string]string, volumes map[string]core.VolumeSource, container *core.Container, fldPath *field.Path, opts PodValidationOptions) field.ErrorList { … } func ValidateVolumeDevices(devices []core.VolumeDevice, volmounts map[string]string, volumes map[string]core.VolumeSource, fldPath *field.Path) field.ErrorList { … } func validatePodResourceClaims(podMeta *metav1.ObjectMeta, claims []core.PodResourceClaim, fldPath *field.Path) field.ErrorList { … } // gatherPodResourceClaimNames returns a set of all non-empty // PodResourceClaim.Name values. Validation that those names are valid is // handled by validatePodResourceClaims. func gatherPodResourceClaimNames(claims []core.PodResourceClaim) sets.Set[string] { … } func validatePodResourceClaim(podMeta *metav1.ObjectMeta, claim core.PodResourceClaim, podClaimNames *sets.Set[string], fldPath *field.Path) field.ErrorList { … } func validateLivenessProbe(probe *core.Probe, gracePeriod *int64, fldPath *field.Path) field.ErrorList { … } func validateReadinessProbe(probe *core.Probe, gracePeriod *int64, fldPath *field.Path) field.ErrorList { … } func validateStartupProbe(probe *core.Probe, gracePeriod *int64, fldPath *field.Path) field.ErrorList { … } func validateProbe(probe *core.Probe, gracePeriod *int64, fldPath *field.Path) field.ErrorList { … } func validateInitContainerRestartPolicy(restartPolicy *core.ContainerRestartPolicy, fldPath *field.Path) field.ErrorList { … } type commonHandler … func handlerFromProbe(ph *core.ProbeHandler) commonHandler { … } func handlerFromLifecycle(lh *core.LifecycleHandler) commonHandler { … } func validateSleepAction(sleep *core.SleepAction, gracePeriod *int64, fldPath *field.Path) field.ErrorList { … } func validateClientIPAffinityConfig(config *core.SessionAffinityConfig, fldPath *field.Path) field.ErrorList { … } func validateAffinityTimeout(timeout *int32, fldPath *field.Path) field.ErrorList { … } // AccumulateUniqueHostPorts extracts each HostPort of each Container, // accumulating the results and returning an error if any ports conflict. func AccumulateUniqueHostPorts(containers []core.Container, accumulator *sets.Set[string], fldPath *field.Path) field.ErrorList { … } // checkHostPortConflicts checks for colliding Port.HostPort values across // a slice of containers. func checkHostPortConflicts(containers []core.Container, fldPath *field.Path) field.ErrorList { … } func validateExecAction(exec *core.ExecAction, fldPath *field.Path) field.ErrorList { … } var supportedHTTPSchemes … func validateHTTPGetAction(http *core.HTTPGetAction, fldPath *field.Path) field.ErrorList { … } func ValidatePortNumOrName(port intstr.IntOrString, fldPath *field.Path) field.ErrorList { … } func validateTCPSocketAction(tcp *core.TCPSocketAction, fldPath *field.Path) field.ErrorList { … } func validateGRPCAction(grpc *core.GRPCAction, fldPath *field.Path) field.ErrorList { … } func validateHandler(handler commonHandler, gracePeriod *int64, fldPath *field.Path) field.ErrorList { … } func validateLifecycle(lifecycle *core.Lifecycle, gracePeriod *int64, fldPath *field.Path) field.ErrorList { … } var supportedPullPolicies … func validatePullPolicy(policy core.PullPolicy, fldPath *field.Path) field.ErrorList { … } var supportedResizeResources … var supportedResizePolicies … func validateResizePolicy(policyList []core.ContainerResizePolicy, fldPath *field.Path, podRestartPolicy *core.RestartPolicy) field.ErrorList { … } // validateEphemeralContainers is called by pod spec and template validation to validate the list of ephemeral containers. // Note that this is called for pod template even though ephemeral containers aren't allowed in pod templates. func validateEphemeralContainers(ephemeralContainers []core.EphemeralContainer, containers, initContainers []core.Container, volumes map[string]core.VolumeSource, podClaimNames sets.Set[string], fldPath *field.Path, opts PodValidationOptions, podRestartPolicy *core.RestartPolicy, hostUsers bool) field.ErrorList { … } // ValidateFieldAcceptList checks that only allowed fields are set. // The value must be a struct (not a pointer to a struct!). func validateFieldAllowList(value interface{ … } // validateInitContainers is called by pod spec and template validation to validate the list of init containers func validateInitContainers(containers []core.Container, regularContainers []core.Container, volumes map[string]core.VolumeSource, podClaimNames sets.Set[string], gracePeriod *int64, fldPath *field.Path, opts PodValidationOptions, podRestartPolicy *core.RestartPolicy, hostUsers bool) field.ErrorList { … } // validateContainerCommon applies validation common to all container types. It's called by regular, init, and ephemeral // container list validation to require a properly formatted name, image, etc. func validateContainerCommon(ctr *core.Container, volumes map[string]core.VolumeSource, podClaimNames sets.Set[string], path *field.Path, opts PodValidationOptions, podRestartPolicy *core.RestartPolicy, hostUsers bool) field.ErrorList { … } func validateHostUsers(spec *core.PodSpec, fldPath *field.Path) field.ErrorList { … } // validateContainers is called by pod spec and template validation to validate the list of regular containers. func validateContainers(containers []core.Container, volumes map[string]core.VolumeSource, podClaimNames sets.Set[string], gracePeriod *int64, fldPath *field.Path, opts PodValidationOptions, podRestartPolicy *core.RestartPolicy, hostUsers bool) field.ErrorList { … } func validateRestartPolicy(restartPolicy *core.RestartPolicy, fldPath *field.Path) field.ErrorList { … } func ValidatePreemptionPolicy(preemptionPolicy *core.PreemptionPolicy, fldPath *field.Path) field.ErrorList { … } func validateDNSPolicy(dnsPolicy *core.DNSPolicy, fldPath *field.Path) field.ErrorList { … } var validFSGroupChangePolicies … func validateFSGroupChangePolicy(fsGroupPolicy *core.PodFSGroupChangePolicy, fldPath *field.Path) field.ErrorList { … } const MaxDNSNameservers … const MaxDNSSearchPaths … const MaxDNSSearchListChars … func validateReadinessGates(readinessGates []core.PodReadinessGate, fldPath *field.Path) field.ErrorList { … } func validateSchedulingGates(schedulingGates []core.PodSchedulingGate, fldPath *field.Path) field.ErrorList { … } func validatePodDNSConfig(dnsConfig *core.PodDNSConfig, dnsPolicy *core.DNSPolicy, fldPath *field.Path, opts PodValidationOptions) field.ErrorList { … } // validatePodHostNetworkDeps checks fields which depend on whether HostNetwork is // true or not. It should be called on all PodSpecs, but opts can change what // is enforce. E.g. opts.ResourceIsPod should only be set when called in the // context of a Pod, and not on PodSpecs which are embedded in other resources // (e.g. Deployments). func validatePodHostNetworkDeps(spec *core.PodSpec, fldPath *field.Path, opts PodValidationOptions) field.ErrorList { … } // validateImagePullSecrets checks to make sure the pull secrets are well // formed. Right now, we only expect name to be set (it's the only field). If // this ever changes and someone decides to set those fields, we'd like to // know. func validateImagePullSecrets(imagePullSecrets []core.LocalObjectReference, fldPath *field.Path) field.ErrorList { … } // validateAffinity checks if given affinities are valid func validateAffinity(affinity *core.Affinity, opts PodValidationOptions, fldPath *field.Path) field.ErrorList { … } func validateTaintEffect(effect *core.TaintEffect, allowEmpty bool, fldPath *field.Path) field.ErrorList { … } // validateOnlyAddedTolerations validates updated pod tolerations. func validateOnlyAddedTolerations(newTolerations []core.Toleration, oldTolerations []core.Toleration, fldPath *field.Path) field.ErrorList { … } func validateOnlyDeletedSchedulingGates(newGates, oldGates []core.PodSchedulingGate, fldPath *field.Path) field.ErrorList { … } func ValidateHostAliases(hostAliases []core.HostAlias, fldPath *field.Path) field.ErrorList { … } // ValidateTolerations tests if given tolerations have valid data. func ValidateTolerations(tolerations []core.Toleration, fldPath *field.Path) field.ErrorList { … } // validateContainersOnlyForPod does additional validation for containers on a pod versus a pod template // it only does additive validation of fields not covered in validateContainers and is not called for // ephemeral containers which require a conversion to core.Container. func validateContainersOnlyForPod(containers []core.Container, fldPath *field.Path) field.ErrorList { … } // validateContainerOnlyForPod does pod-only (i.e. not pod template) validation for a single container. // This is called by validateContainersOnlyForPod and validateEphemeralContainers directly. func validateContainerOnlyForPod(ctr *core.Container, path *field.Path) field.ErrorList { … } type PodValidationOptions … // validatePodMetadataAndSpec tests if required fields in the pod.metadata and pod.spec are set, // and is called by ValidatePodCreate and ValidatePodUpdate. func validatePodMetadataAndSpec(pod *core.Pod, opts PodValidationOptions) field.ErrorList { … } // validatePodIPs validates IPs in pod status func validatePodIPs(pod *core.Pod) field.ErrorList { … } // validateHostIPs validates IPs in pod status func validateHostIPs(pod *core.Pod) field.ErrorList { … } // ValidatePodSpec tests that the specified PodSpec has valid data. // This includes checking formatting and uniqueness. It also canonicalizes the // structure by setting default values and implementing any backwards-compatibility // tricks. // The pod metadata is needed to validate generic ephemeral volumes. It is optional // and should be left empty unless the spec is from a real pod object. func ValidatePodSpec(spec *core.PodSpec, podMeta *metav1.ObjectMeta, fldPath *field.Path, opts PodValidationOptions) field.ErrorList { … } func validateLinux(spec *core.PodSpec, fldPath *field.Path) field.ErrorList { … } func validateWindows(spec *core.PodSpec, fldPath *field.Path) field.ErrorList { … } // ValidateNodeSelectorRequirement tests that the specified NodeSelectorRequirement fields has valid data func ValidateNodeSelectorRequirement(rq core.NodeSelectorRequirement, fldPath *field.Path) field.ErrorList { … } var nodeFieldSelectorValidators … // ValidateNodeFieldSelectorRequirement tests that the specified NodeSelectorRequirement fields has valid data func ValidateNodeFieldSelectorRequirement(req core.NodeSelectorRequirement, fldPath *field.Path) field.ErrorList { … } // ValidateNodeSelectorTerm tests that the specified node selector term has valid data func ValidateNodeSelectorTerm(term core.NodeSelectorTerm, fldPath *field.Path) field.ErrorList { … } // ValidateNodeSelector tests that the specified nodeSelector fields has valid data func ValidateNodeSelector(nodeSelector *core.NodeSelector, fldPath *field.Path) field.ErrorList { … } // validateTopologySelectorLabelRequirement tests that the specified TopologySelectorLabelRequirement fields has valid data, // and constructs a set containing all of its Values. func validateTopologySelectorLabelRequirement(rq core.TopologySelectorLabelRequirement, fldPath *field.Path) (sets.Set[string], field.ErrorList) { … } // ValidateTopologySelectorTerm tests that the specified topology selector term has valid data, // and constructs a map representing the term in raw form. func ValidateTopologySelectorTerm(term core.TopologySelectorTerm, fldPath *field.Path) (map[string]sets.Set[string], field.ErrorList) { … } // ValidateAvoidPodsInNodeAnnotations tests that the serialized AvoidPods in Node.Annotations has valid data func ValidateAvoidPodsInNodeAnnotations(annotations map[string]string, fldPath *field.Path) field.ErrorList { … } // validatePreferAvoidPodsEntry tests if given PreferAvoidPodsEntry has valid data. func validatePreferAvoidPodsEntry(avoidPodEntry core.PreferAvoidPodsEntry, fldPath *field.Path) field.ErrorList { … } // ValidatePreferredSchedulingTerms tests that the specified SoftNodeAffinity fields has valid data func ValidatePreferredSchedulingTerms(terms []core.PreferredSchedulingTerm, fldPath *field.Path) field.ErrorList { … } // validatePodAffinityTerm tests that the specified podAffinityTerm fields have valid data func validatePodAffinityTerm(podAffinityTerm core.PodAffinityTerm, allowInvalidLabelValueInSelector bool, fldPath *field.Path) field.ErrorList { … } // validatePodAffinityTerms tests that the specified podAffinityTerms fields have valid data func validatePodAffinityTerms(podAffinityTerms []core.PodAffinityTerm, allowInvalidLabelValueInSelector bool, fldPath *field.Path) field.ErrorList { … } // validateWeightedPodAffinityTerms tests that the specified weightedPodAffinityTerms fields have valid data func validateWeightedPodAffinityTerms(weightedPodAffinityTerms []core.WeightedPodAffinityTerm, allowInvalidLabelValueInSelector bool, fldPath *field.Path) field.ErrorList { … } // validatePodAntiAffinity tests that the specified podAntiAffinity fields have valid data func validatePodAntiAffinity(podAntiAffinity *core.PodAntiAffinity, allowInvalidLabelValueInSelector bool, fldPath *field.Path) field.ErrorList { … } // validateNodeAffinity tests that the specified nodeAffinity fields have valid data func validateNodeAffinity(na *core.NodeAffinity, fldPath *field.Path) field.ErrorList { … } // validatePodAffinity tests that the specified podAffinity fields have valid data func validatePodAffinity(podAffinity *core.PodAffinity, allowInvalidLabelValueInSelector bool, fldPath *field.Path) field.ErrorList { … } func validateSeccompProfileField(sp *core.SeccompProfile, fldPath *field.Path) field.ErrorList { … } func ValidateSeccompProfile(p string, fldPath *field.Path) field.ErrorList { … } func ValidateSeccompPodAnnotations(annotations map[string]string, fldPath *field.Path) field.ErrorList { … } // ValidateSeccompProfileType tests that the argument is a valid SeccompProfileType. func validateSeccompProfileType(fldPath *field.Path, seccompProfileType core.SeccompProfileType) *field.Error { … } func ValidateAppArmorProfileField(profile *core.AppArmorProfile, fldPath *field.Path) field.ErrorList { … } func ValidateAppArmorPodAnnotations(annotations map[string]string, spec *core.PodSpec, fldPath *field.Path) field.ErrorList { … } func ValidateAppArmorProfileFormat(profile string) error { … } // validateAppArmorAnnotationsAndFieldsMatchOnCreate validates that AppArmor fields and annotations are consistent. func validateAppArmorAnnotationsAndFieldsMatchOnCreate(objectMeta metav1.ObjectMeta, podSpec *core.PodSpec, specPath *field.Path) field.ErrorList { … } func podSpecHasContainer(spec *core.PodSpec, containerName string) bool { … } const SysctlSegmentFmt … const SysctlContainSlashFmt … const SysctlMaxLength … var sysctlContainSlashRegexp … // IsValidSysctlName checks that the given string is a valid sysctl name, // i.e. matches SysctlContainSlashFmt. // More info: // // https://man7.org/linux/man-pages/man8/sysctl.8.html // https://man7.org/linux/man-pages/man5/sysctl.d.5.html func IsValidSysctlName(name string) bool { … } func validateSysctls(securityContext *core.PodSecurityContext, fldPath *field.Path, opts PodValidationOptions) field.ErrorList { … } // ValidateHostSysctl will return error if namespaced sysctls is applied to pod sharing the respective namespaces with the host. func ValidateHostSysctl(sysctl string, securityContext *core.PodSecurityContext, fldPath *field.Path) *field.Error { … } // validatePodSpecSecurityContext verifies the SecurityContext of a PodSpec, // whether that is defined in a Pod or in an embedded PodSpec (e.g. a // Deployment's pod template). func validatePodSpecSecurityContext(securityContext *core.PodSecurityContext, spec *core.PodSpec, specPath, fldPath *field.Path, opts PodValidationOptions) field.ErrorList { … } func ValidateContainerUpdates(newContainers, oldContainers []core.Container, fldPath *field.Path) (allErrs field.ErrorList, stop bool) { … } // ValidatePodCreate validates a pod in the context of its initial create func ValidatePodCreate(pod *core.Pod, opts PodValidationOptions) field.ErrorList { … } // validateSeccompAnnotationsAndFields iterates through all containers and ensure that when both seccompProfile and seccomp annotations exist they match. func validateSeccompAnnotationsAndFields(objectMeta metav1.ObjectMeta, podSpec *core.PodSpec, specPath *field.Path) field.ErrorList { … } func validateSeccompAnnotationsAndFieldsMatch(annotationValue string, seccompField *core.SeccompProfile, fldPath *field.Path) *field.Error { … } var updatablePodSpecFields … var updatablePodSpecFieldsNoResources … // ValidatePodUpdate tests to see if the update is legal for an end user to make. newPod is updated with fields // that cannot be changed. func ValidatePodUpdate(newPod, oldPod *core.Pod, opts PodValidationOptions) field.ErrorList { … } // ValidateContainerStateTransition test to if any illegal container state transitions are being attempted func ValidateContainerStateTransition(newStatuses, oldStatuses []core.ContainerStatus, fldpath *field.Path, restartPolicy core.RestartPolicy) field.ErrorList { … } // ValidateInitContainerStateTransition test to if any illegal init container state transitions are being attempted func ValidateInitContainerStateTransition(newStatuses, oldStatuses []core.ContainerStatus, fldpath *field.Path, podSpec *core.PodSpec) field.ErrorList { … } // ValidatePodStatusUpdate checks for changes to status that shouldn't occur in normal operation. func ValidatePodStatusUpdate(newPod, oldPod *core.Pod, opts PodValidationOptions) field.ErrorList { … } // validatePodConditions tests if the custom pod conditions are valid. func validatePodConditions(conditions []core.PodCondition, fldPath *field.Path) field.ErrorList { … } // validatePodResourceClaimStatuses validates the ResourceClaimStatuses slice in a pod status. func validatePodResourceClaimStatuses(statuses []core.PodResourceClaimStatus, podClaims []core.PodResourceClaim, fldPath *field.Path) field.ErrorList { … } func havePodClaim(podClaims []core.PodResourceClaim, name string) bool { … } // ValidatePodEphemeralContainersUpdate tests that a user update to EphemeralContainers is valid. // newPod and oldPod must only differ in their EphemeralContainers. func ValidatePodEphemeralContainersUpdate(newPod, oldPod *core.Pod, opts PodValidationOptions) field.ErrorList { … } // ValidatePodBinding tests if required fields in the pod binding are legal. func ValidatePodBinding(binding *core.Binding) field.ErrorList { … } // ValidatePodTemplate tests if required fields in the pod template are set. func ValidatePodTemplate(pod *core.PodTemplate, opts PodValidationOptions) field.ErrorList { … } // ValidatePodTemplateUpdate tests to see if the update is legal for an end user to make. newPod is updated with fields // that cannot be changed. func ValidatePodTemplateUpdate(newPod, oldPod *core.PodTemplate, opts PodValidationOptions) field.ErrorList { … } var supportedSessionAffinityType … var supportedServiceType … var supportedServiceInternalTrafficPolicy … var supportedServiceIPFamily … var supportedServiceIPFamilyPolicy … // ValidateService tests if required fields/annotations of a Service are valid. func ValidateService(service *core.Service) field.ErrorList { … } func validateServicePort(sp *core.ServicePort, requireName, isHeadlessService bool, allNames *sets.Set[string], fldPath *field.Path) field.ErrorList { … } var validExternalTrafficPolicies … func validateServiceExternalTrafficPolicy(service *core.Service) field.ErrorList { … } func validateServiceExternalTrafficFieldsUpdate(before, after *core.Service) field.ErrorList { … } // validateServiceInternalTrafficFieldsValue validates InternalTraffic related // spec have legal value. func validateServiceInternalTrafficFieldsValue(service *core.Service) field.ErrorList { … } // validateServiceTrafficDistribution validates the values for the // trafficDistribution field. func validateServiceTrafficDistribution(service *core.Service) field.ErrorList { … } // ValidateServiceCreate validates Services as they are created. func ValidateServiceCreate(service *core.Service) field.ErrorList { … } // ValidateServiceUpdate tests if required fields in the service are set during an update func ValidateServiceUpdate(service, oldService *core.Service) field.ErrorList { … } // ValidateServiceStatusUpdate tests if required fields in the Service are set when updating status. func ValidateServiceStatusUpdate(service, oldService *core.Service) field.ErrorList { … } // ValidateReplicationController tests if required fields in the replication controller are set. func ValidateReplicationController(controller *core.ReplicationController, opts PodValidationOptions) field.ErrorList { … } // ValidateReplicationControllerUpdate tests if required fields in the replication controller are set. func ValidateReplicationControllerUpdate(controller, oldController *core.ReplicationController, opts PodValidationOptions) field.ErrorList { … } // ValidateReplicationControllerStatusUpdate tests if required fields in the replication controller are set. func ValidateReplicationControllerStatusUpdate(controller, oldController *core.ReplicationController) field.ErrorList { … } func ValidateReplicationControllerStatus(status core.ReplicationControllerStatus, statusPath *field.Path) field.ErrorList { … } // Validates that the given selector is non-empty. func ValidateNonEmptySelector(selectorMap map[string]string, fldPath *field.Path) field.ErrorList { … } // Validates the given template and ensures that it is in accordance with the desired selector and replicas. func ValidatePodTemplateSpecForRC(template *core.PodTemplateSpec, selectorMap map[string]string, replicas int32, fldPath *field.Path, opts PodValidationOptions) field.ErrorList { … } // ValidateReplicationControllerSpec tests if required fields in the replication controller spec are set. func ValidateReplicationControllerSpec(spec, oldSpec *core.ReplicationControllerSpec, fldPath *field.Path, opts PodValidationOptions) field.ErrorList { … } // ValidatePodTemplateSpec validates the spec of a pod template func ValidatePodTemplateSpec(spec *core.PodTemplateSpec, fldPath *field.Path, opts PodValidationOptions) field.ErrorList { … } // ValidateTaintsInNodeAnnotations tests that the serialized taints in Node.Annotations has valid data func ValidateTaintsInNodeAnnotations(annotations map[string]string, fldPath *field.Path) field.ErrorList { … } // validateNodeTaints tests if given taints have valid data. func validateNodeTaints(taints []core.Taint, fldPath *field.Path) field.ErrorList { … } func ValidateNodeSpecificAnnotations(annotations map[string]string, fldPath *field.Path) field.ErrorList { … } // ValidateNode tests if required fields in the node are set. func ValidateNode(node *core.Node) field.ErrorList { … } // ValidateNodeResources is used to make sure a node has valid capacity and allocatable values. func ValidateNodeResources(node *core.Node) field.ErrorList { … } // ValidateNodeUpdate tests to make sure a node update can be applied. Modifies oldNode. func ValidateNodeUpdate(node, oldNode *core.Node) field.ErrorList { … } // validation specific to Node.Spec.ConfigSource // The field ConfigSource is deprecated and will not be used. The validation is kept in place // for the backward compatibility func validateNodeConfigSourceSpec(source *core.NodeConfigSource, fldPath *field.Path) field.ErrorList { … } // validation specific to Node.Spec.ConfigSource.ConfigMap // The field ConfigSource is deprecated and will not be used. The validation is kept in place // for the backward compatibility func validateConfigMapNodeConfigSourceSpec(source *core.ConfigMapNodeConfigSource, fldPath *field.Path) field.ErrorList { … } // validation specififc to Node.Status.Config func validateNodeConfigStatus(status *core.NodeConfigStatus, fldPath *field.Path) field.ErrorList { … } // validation specific to Node.Status.Config.(Active|Assigned|LastKnownGood) func validateNodeConfigSourceStatus(source *core.NodeConfigSource, fldPath *field.Path) field.ErrorList { … } // validation specific to Node.Status.Config.(Active|Assigned|LastKnownGood).ConfigMap func validateConfigMapNodeConfigSourceStatus(source *core.ConfigMapNodeConfigSource, fldPath *field.Path) field.ErrorList { … } // common validation func validateConfigMapNodeConfigSource(source *core.ConfigMapNodeConfigSource, fldPath *field.Path) field.ErrorList { … } // Validate compute resource typename. // Refer to docs/design/resources.md for more details. func validateResourceName(value core.ResourceName, fldPath *field.Path) field.ErrorList { … } // Validate container resource name // Refer to docs/design/resources.md for more details. func validateContainerResourceName(value core.ResourceName, fldPath *field.Path) field.ErrorList { … } // Validate resource names that can go in a resource quota // Refer to docs/design/resources.md for more details. func ValidateResourceQuotaResourceName(value core.ResourceName, fldPath *field.Path) field.ErrorList { … } // Validate limit range types func validateLimitRangeTypeName(value core.LimitType, fldPath *field.Path) field.ErrorList { … } // Validate limit range resource name // limit types (other than Pod/Container) could contain storage not just cpu or memory func validateLimitRangeResourceName(limitType core.LimitType, value core.ResourceName, fldPath *field.Path) field.ErrorList { … } // ValidateLimitRange tests if required fields in the LimitRange are set. func ValidateLimitRange(limitRange *core.LimitRange) field.ErrorList { … } // ValidateServiceAccount tests if required fields in the ServiceAccount are set. func ValidateServiceAccount(serviceAccount *core.ServiceAccount) field.ErrorList { … } // ValidateServiceAccountUpdate tests if required fields in the ServiceAccount are set. func ValidateServiceAccountUpdate(newServiceAccount, oldServiceAccount *core.ServiceAccount) field.ErrorList { … } // ValidateSecret tests if required fields in the Secret are set. func ValidateSecret(secret *core.Secret) field.ErrorList { … } // ValidateSecretUpdate tests if required fields in the Secret are set. func ValidateSecretUpdate(newSecret, oldSecret *core.Secret) field.ErrorList { … } var ValidateConfigMapName … // ValidateConfigMap tests whether required fields in the ConfigMap are set. func ValidateConfigMap(cfg *core.ConfigMap) field.ErrorList { … } // ValidateConfigMapUpdate tests if required fields in the ConfigMap are set. func ValidateConfigMapUpdate(newCfg, oldCfg *core.ConfigMap) field.ErrorList { … } func validateBasicResource(quantity resource.Quantity, fldPath *field.Path) field.ErrorList { … } // Validates resource requirement spec. func ValidateResourceRequirements(requirements *core.ResourceRequirements, podClaimNames sets.Set[string], fldPath *field.Path, opts PodValidationOptions) field.ErrorList { … } // validateResourceClaimNames checks that the names in // ResourceRequirements.Claims have a corresponding entry in // PodSpec.ResourceClaims. func validateResourceClaimNames(claims []core.ResourceClaim, podClaimNames sets.Set[string], fldPath *field.Path) field.ErrorList { … } func validateResourceQuantityHugePageValue(name core.ResourceName, quantity resource.Quantity, opts PodValidationOptions) error { … } // validateResourceQuotaScopes ensures that each enumerated hard resource constraint is valid for set of scopes func validateResourceQuotaScopes(resourceQuotaSpec *core.ResourceQuotaSpec, fld *field.Path) field.ErrorList { … } // validateScopedResourceSelectorRequirement tests that the match expressions has valid data func validateScopedResourceSelectorRequirement(resourceQuotaSpec *core.ResourceQuotaSpec, fld *field.Path) field.ErrorList { … } // validateScopeSelector tests that the specified scope selector has valid data func validateScopeSelector(resourceQuotaSpec *core.ResourceQuotaSpec, fld *field.Path) field.ErrorList { … } // ValidateResourceQuota tests if required fields in the ResourceQuota are set. func ValidateResourceQuota(resourceQuota *core.ResourceQuota) field.ErrorList { … } func ValidateResourceQuotaStatus(status *core.ResourceQuotaStatus, fld *field.Path) field.ErrorList { … } func ValidateResourceQuotaSpec(resourceQuotaSpec *core.ResourceQuotaSpec, fld *field.Path) field.ErrorList { … } // ValidateResourceQuantityValue enforces that specified quantity is valid for specified resource func ValidateResourceQuantityValue(resource core.ResourceName, value resource.Quantity, fldPath *field.Path) field.ErrorList { … } // ValidateResourceQuotaUpdate tests to see if the update is legal for an end user to make. func ValidateResourceQuotaUpdate(newResourceQuota, oldResourceQuota *core.ResourceQuota) field.ErrorList { … } // ValidateResourceQuotaStatusUpdate tests to see if the status update is legal for an end user to make. func ValidateResourceQuotaStatusUpdate(newResourceQuota, oldResourceQuota *core.ResourceQuota) field.ErrorList { … } // ValidateNamespace tests if required fields are set. func ValidateNamespace(namespace *core.Namespace) field.ErrorList { … } // Validate finalizer names func validateFinalizerName(stringValue string, fldPath *field.Path) field.ErrorList { … } // validateKubeFinalizerName checks for "standard" names of legacy finalizer func validateKubeFinalizerName(stringValue string, fldPath *field.Path) field.ErrorList { … } // ValidateNamespaceUpdate tests to make sure a namespace update can be applied. func ValidateNamespaceUpdate(newNamespace *core.Namespace, oldNamespace *core.Namespace) field.ErrorList { … } // ValidateNamespaceStatusUpdate tests to see if the update is legal for an end user to make. func ValidateNamespaceStatusUpdate(newNamespace, oldNamespace *core.Namespace) field.ErrorList { … } // ValidateNamespaceFinalizeUpdate tests to see if the update is legal for an end user to make. func ValidateNamespaceFinalizeUpdate(newNamespace, oldNamespace *core.Namespace) field.ErrorList { … } // ValidateEndpoints validates Endpoints on create and update. func ValidateEndpoints(endpoints *core.Endpoints) field.ErrorList { … } // ValidateEndpointsCreate validates Endpoints on create. func ValidateEndpointsCreate(endpoints *core.Endpoints) field.ErrorList { … } // ValidateEndpointsUpdate validates Endpoints on update. NodeName changes are // allowed during update to accommodate the case where nodeIP or PodCIDR is // reused. An existing endpoint ip will have a different nodeName if this // happens. func ValidateEndpointsUpdate(newEndpoints, oldEndpoints *core.Endpoints) field.ErrorList { … } func validateEndpointSubsets(subsets []core.EndpointSubset, fldPath *field.Path) field.ErrorList { … } func validateEndpointAddress(address *core.EndpointAddress, fldPath *field.Path) field.ErrorList { … } // ValidateNonSpecialIP is used to validate Endpoints, EndpointSlices, and // external IPs. Specifically, this disallows unspecified and loopback addresses // are nonsensical and link-local addresses tend to be used for node-centric // purposes (e.g. metadata service). // // IPv6 references // - https://www.iana.org/assignments/iana-ipv6-special-registry/iana-ipv6-special-registry.xhtml // - https://www.iana.org/assignments/ipv6-multicast-addresses/ipv6-multicast-addresses.xhtml func ValidateNonSpecialIP(ipAddress string, fldPath *field.Path) field.ErrorList { … } func validateEndpointPort(port *core.EndpointPort, requireName bool, fldPath *field.Path) field.ErrorList { … } // ValidateSecurityContext ensures the security context contains valid settings func ValidateSecurityContext(sc *core.SecurityContext, fldPath *field.Path, hostUsers bool) field.ErrorList { … } const maxGMSACredentialSpecLengthInKiB … const maxGMSACredentialSpecLength … const maxRunAsUserNameDomainLength … const maxRunAsUserNameUserLength … var ctrlRegex … var validNetBiosRegex … var dnsLabelFormat … var dnsSubdomainFormat … var validWindowsUserDomainDNSRegex … var invalidUserNameCharsRegex … var invalidUserNameDotsSpacesRegex … func validateWindowsSecurityContextOptions(windowsOptions *core.WindowsSecurityContextOptions, fieldPath *field.Path) field.ErrorList { … } func validateWindowsHostProcessPod(podSpec *core.PodSpec, fieldPath *field.Path) field.ErrorList { … } // validateOS validates the OS field within pod spec func validateOS(podSpec *core.PodSpec, fldPath *field.Path, opts PodValidationOptions) field.ErrorList { … } func ValidatePodLogOptions(opts *core.PodLogOptions) field.ErrorList { … } var supportedLoadBalancerIPMode … // ValidateLoadBalancerStatus validates required fields on a LoadBalancerStatus func ValidateLoadBalancerStatus(status *core.LoadBalancerStatus, fldPath *field.Path, spec *core.ServiceSpec) field.ErrorList { … } // validateVolumeNodeAffinity tests that the PersistentVolume.NodeAffinity has valid data // returns: // - true if volumeNodeAffinity is set // - errorList if there are validation errors func validateVolumeNodeAffinity(nodeAffinity *core.VolumeNodeAffinity, fldPath *field.Path) (bool, field.ErrorList) { … } func IsDecremented(update, old *int32) bool { … } // ValidateProcMountType tests that the argument is a valid ProcMountType. func ValidateProcMountType(fldPath *field.Path, procMountType core.ProcMountType) *field.Error { … } var supportedScheduleActions … // validateTopologySpreadConstraints validates given TopologySpreadConstraints. func validateTopologySpreadConstraints(constraints []core.TopologySpreadConstraint, fldPath *field.Path, opts PodValidationOptions) field.ErrorList { … } // ValidateMaxSkew tests that the argument is a valid MaxSkew. func ValidateMaxSkew(fldPath *field.Path, maxSkew int32) *field.Error { … } // validateMinDomains tests that the argument is a valid MinDomains. func validateMinDomains(fldPath *field.Path, minDomains *int32, action core.UnsatisfiableConstraintAction) field.ErrorList { … } // ValidateTopologyKey tests that the argument is a valid TopologyKey. func ValidateTopologyKey(fldPath *field.Path, topologyKey string) *field.Error { … } // ValidateWhenUnsatisfiable tests that the argument is a valid UnsatisfiableConstraintAction. func ValidateWhenUnsatisfiable(fldPath *field.Path, action core.UnsatisfiableConstraintAction) *field.Error { … } // ValidateSpreadConstraintNotRepeat tests that if `constraint` duplicates with `existingConstraintPairs` // on TopologyKey and WhenUnsatisfiable fields. func ValidateSpreadConstraintNotRepeat(fldPath *field.Path, constraint core.TopologySpreadConstraint, restingConstraints []core.TopologySpreadConstraint) *field.Error { … } var supportedPodTopologySpreadNodePolicies … // validateNodeAffinityPolicy tests that the argument is a valid NodeInclusionPolicy. func validateNodeInclusionPolicy(fldPath *field.Path, policy *core.NodeInclusionPolicy) *field.Error { … } // validateMatchLabelKeysAndMismatchLabelKeys checks if both matchLabelKeys and mismatchLabelKeys are valid. // - validate that all matchLabelKeys and mismatchLabelKeys are valid label names. // - validate that the user doens't specify the same key in both matchLabelKeys and labelSelector. // - validate that any matchLabelKeys are not duplicated with mismatchLabelKeys. func validateMatchLabelKeysAndMismatchLabelKeys(fldPath *field.Path, matchLabelKeys, mismatchLabelKeys []string, labelSelector *metav1.LabelSelector) field.ErrorList { … } // validateMatchLabelKeysInTopologySpread tests that the elements are a valid label name and are not already included in labelSelector. func validateMatchLabelKeysInTopologySpread(fldPath *field.Path, matchLabelKeys []string, labelSelector *metav1.LabelSelector) field.ErrorList { … } // validateLabelKeys tests that the label keys are a valid label name. // It's intended to be used for matchLabelKeys or mismatchLabelKeys. func validateLabelKeys(fldPath *field.Path, labelKeys []string, labelSelector *metav1.LabelSelector) field.ErrorList { … } // ValidateServiceClusterIPsRelatedFields validates .spec.ClusterIPs,, // .spec.IPFamilies, .spec.ipFamilyPolicy. This is exported because it is used // during IP init and allocation. func ValidateServiceClusterIPsRelatedFields(service *core.Service) field.ErrorList { … } // specific validation for clusterIPs in cases of user upgrading or downgrading to/from dualstack func validateUpgradeDowngradeClusterIPs(oldService, service *core.Service) field.ErrorList { … } // specific validation for ipFamilies in cases of user upgrading or downgrading to/from dualstack func validateUpgradeDowngradeIPFamilies(oldService, service *core.Service) field.ErrorList { … } func isHeadlessService(service *core.Service) bool { … } // validateLoadBalancerClassField validation for loadBalancerClass func validateLoadBalancerClassField(oldService, service *core.Service) field.ErrorList { … } // isTypeLoadBalancer tests service type is loadBalancer or not func isTypeLoadBalancer(service *core.Service) bool { … } // sameLoadBalancerClass check two services have the same loadBalancerClass or not func sameLoadBalancerClass(oldService, service *core.Service) bool { … } func ValidatePodAffinityTermSelector(podAffinityTerm core.PodAffinityTerm, allowInvalidLabelValueInSelector bool, fldPath *field.Path) field.ErrorList { … } var betaToGALabel … var maskNodeSelectorLabelChangeEqualities … var initMaskNodeSelectorLabelChangeEqualities … func getMaskNodeSelectorLabelChangeEqualities() conversion.Equalities { … } func validatePvNodeAffinity(newPvNodeAffinity, oldPvNodeAffinity *core.VolumeNodeAffinity, fldPath *field.Path) field.ErrorList { … } func validateNodeSelectorMutation(fldPath *field.Path, newNodeSelector, oldNodeSelector map[string]string) field.ErrorList { … } func validateNodeAffinityMutation(nodeAffinityPath *field.Path, newNodeAffinity, oldNodeAffinity *core.NodeAffinity) field.ErrorList { … } func validateNodeSelectorTermHasOnlyAdditions(newTerm, oldTerm core.NodeSelectorTerm) bool { … } var validSupplementalGroupsPolicies … func validateSupplementalGroupsPolicy(supplementalGroupsPolicy *core.SupplementalGroupsPolicy, fldPath *field.Path) field.ErrorList { … } func validateContainerStatusUsers(containerStatuses []core.ContainerStatus, fldPath *field.Path, podOS *core.PodOS) field.ErrorList { … } func validateContainerStatusNoAllocatedResourcesStatus(containerStatuses []core.ContainerStatus, fldPath *field.Path) field.ErrorList { … } // validateContainerStatusAllocatedResourcesStatus iterate the allocated resources health and validate: // - resourceName matches one of resources in container's resource requirements // - resourceID is not empty and unique func validateContainerStatusAllocatedResourcesStatus(containerStatuses []core.ContainerStatus, fldPath *field.Path, containers []core.Container) field.ErrorList { … } func validateLinuxContainerUser(linuxContainerUser *core.LinuxContainerUser, fldPath *field.Path) field.ErrorList { … } func validateImageVolumeSource(imageVolume *core.ImageVolumeSource, fldPath *field.Path, opts PodValidationOptions) field.ErrorList { … }
Codebase Browser
kubernetes