ValidatingAdmissionPolicyBinding [page]deterministic

`apiVersion: admissionregistration.k8s.io/v1`

`import "k8s.io/api/admissionregistration/v1"`

## ValidatingAdmissionPolicyBinding {#ValidatingAdmissionPolicyBinding}

ValidatingAdmissionPolicyBinding binds the ValidatingAdmissionPolicy with paramerized resources. ValidatingAdmissionPolicyBinding and parameter CRDs together define how cluster administrators configure policies for clusters.

For a given admission request, each binding will cause its policy to be evaluated N times, where N is 1 for policies/bindings that don't use params, otherwise N is the number of parameters selected by the binding.

The CEL expressions of a policy must have a computed CEL cost below the maximum CEL budget. Each evaluation of the policy is given an independent CEL cost budget. Adding/removing policies, bindings, or params can not affect whether a given (policy, binding, param) combination is within its own CEL budget.

<hr>

<table> <thead><tr><th>Field</th><th>Description</th></tr></thead> <tbody> <tr> <td><code>apiVersion</code><br/><em>string</em></td> <td>APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources</td> </tr> <tr> <td><code>kind</code><br/><em>string</em></td> <td>Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds</td> </tr> <tr> <td><code>metadata</code><br/><em><a href="">ObjectMeta</a></em></td> <td>metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.</td> </tr> <tr> <td><code>spec</code>&nbsp;<strong>*</strong><br/><em><a href="">ValidatingAdmissionPolicyBindingSpec</a></em></td> <td>spec defines the desired behavior of the ValidatingAdmissionPolicyBinding.</td> </tr> </tbody> </table>

## ValidatingAdmissionPolicyBindingSpec {#ValidatingAdmissionPolicyBindingSpec}

ValidatingAdmissionPolicyBindingSpec is the specification of the ValidatingAdmissionPolicyBinding.

<hr>

<table> <thead><tr><th>Field</th><th>Description</th></tr></thead> <tbody> <tr> <td><code>matchResources</code><br/><em><a href="">MatchResources</a></em></td> <td>matchResources declares what resources match this binding and will be validated by it. Note that this is intersected with the policy's matchConstraints, so only requests that are matched by the policy can be selected by this. If this is unset, all resources matched by the policy are validated by this binding When resourceRules is unset, it does not constrain resource matching. If a resource is matched by the other fields of this object, it will be validated. Note that this is differs from ValidatingAdmissionPolicy matchConstraints, where resourceRules are required.</td> </tr> <tr> <td><code>paramRef</code><br/><em><a href="">ParamRef</a></em></td> <td>paramRef specifies the parameter resource used to configure the admission control policy. It should point to a resource of the type specified in ParamKind of the bound ValidatingAdmissionPolicy. If the policy specifies a ParamKind and the resource referred to by ParamRef does not exist, this binding is considered mis-configured and the FailurePolicy of the ValidatingAdmissionPolicy applied. If the policy does not specify a ParamKind then this field is ignored, and the rules are evaluated without a param.</td> </tr> <tr> <td><code>policyName</code>&nbsp;<strong>*</strong><br/><em>string</em></td> <td>policyName references a ValidatingAdmissio …(trimmed)