ValidatingAdmissionPolicy [page]deterministic

`apiVersion: admissionregistration.k8s.io/v1`

`import "k8s.io/api/admissionregistration/v1"`

## ValidatingAdmissionPolicy {#ValidatingAdmissionPolicy}

ValidatingAdmissionPolicy describes the definition of an admission validation policy that accepts or rejects an object without changing it.

<hr>

<table> <thead><tr><th>Field</th><th>Description</th></tr></thead> <tbody> <tr> <td><code>apiVersion</code><br/><em>string</em></td> <td>APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources</td> </tr> <tr> <td><code>kind</code><br/><em>string</em></td> <td>Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds</td> </tr> <tr> <td><code>metadata</code><br/><em><a href="">ObjectMeta</a></em></td> <td>metadata is the standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.</td> </tr> <tr> <td><code>spec</code><br/><em><a href="">ValidatingAdmissionPolicySpec</a></em></td> <td>spec defines the desired behavior of the ValidatingAdmissionPolicy.</td> </tr> <tr> <td><code>status</code><br/><em><a href="">ValidatingAdmissionPolicyStatus</a></em></td> <td>status represents the current status of the ValidatingAdmissionPolicy, including warnings that are useful to determine if the policy behaves in the expected way. Populated by the system. Read-only.</td> </tr> </tbody> </table>

## ValidatingAdmissionPolicySpec {#ValidatingAdmissionPolicySpec}

ValidatingAdmissionPolicySpec is the specification of the desired behavior of the AdmissionPolicy.

<hr>

<table> <thead><tr><th>Field</th><th>Description</th></tr></thead> <tbody> <tr> <td><code>auditAnnotations</code><br/><em><a href="">AuditAnnotation array</a></em></td> <td>auditAnnotations contains CEL expressions which are used to produce audit annotations for the audit event of the API request. validations and auditAnnotations may not both be empty; a least one of validations or auditAnnotations is required.</td> </tr> <tr> <td><code>failurePolicy</code><br/><em>string</em></td> <td>failurePolicy defines how to handle failures for the admission policy. Failures can occur from CEL expression parse errors, type check errors, runtime errors and invalid or mis-configured policy definitions or bindings. A policy is invalid if spec.paramKind refers to a non-existent Kind. A binding is invalid if spec.paramRef.name refers to a non-existent resource. failurePolicy does not define how validations that evaluate to false are handled. When failurePolicy is set to Fail, ValidatingAdmissionPolicyBinding validationActions define how failures are enforced. Allowed values are Ignore or Fail. Defaults to Fail.<br/><br/>Possible enum values:<br/> - `"Fail"` means that an error calling the webhook causes the admission to fail.<br/> - `"Ignore"` means that an error calling the webhook is ignored.</td> </tr> <tr> <td><code>matchConditions</code><br/><em><a href="">MatchCondition array</a></em><br/><em>patch strategy: merge on key <code>name</code></em></td> <td>matchConditions is a list of conditions that must be met for a request to be validated. Match conditions filter requests that have already been matched by the rules, namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests. There are a maximum of 64 match conditions allowed. If a parameter object is provided, it ca …(trimmed)