Skip to main content
Version: v0.35 Stable

Denying proxy requests

Experimental Feature

This feature is experimental. Breaking changes may occur between releases. It may become Enterprise-only or be deprecated. Not recommended for production use.

Enterprise-Only Feature

This feature is an Enterprise feature. See our pricing plans or contact our sales team for more information.

Configure denying proxy requests based on rules.

  • Only validation based on matched namespaces, and resource group / kind / version and request verbs are supported.
  • No mutation of requests, only allow / deny.

Example​

experimental:
  denyProxyRequests:
  - name: "Deny \"protected\" namespace"
    namespaces:
    - protected
    rules:
    - operations:
      - delete
      - update
      - patch
      apiGroups:
      - ''
      apiVersions:
      - "*"
      resources:
      - "namespaces/*"
      scope: Cluster
    - operations:
      - create
      - delete
      - update
      - patch
      apiGroups:
      - "*"
      apiVersions:
      - "*"
      resources:
      - "*"
      scope: Namespaced
    excludedUsers:
    - system:admin
    - system:serviceaccount:default:excluded

Config reference​

denyProxyRequests object[] ​

DenyProxyRequests denies certain requests in the vCluster proxy.

name string ​

The name of the check.

namespaces string[] ​

Namespace describe a list of namespaces that will be affected by the check. An empty list means that all namespaces will be affected. In case of ClusterScoped rules, only the Namespace resource is affected.

rules object[] ​

Rules describes on which verbs and on what resources/subresources the webhook is enforced. The webhook is enforced if it matches any Rule. The version of the request must match the rule version exactly. Equivalent matching is not supported.

apiGroups string[] ​

APIGroups is the API groups the resources belong to. '*' is all groups.

apiVersions string[] ​

APIVersions is the API versions the resources belong to. '*' is all versions.

resources string[] ​

Resources is a list of resources this rule applies to.

scope string ​

Scope specifies the scope of this rule.

operations string[] ​

Verb is the kube verb associated with the request for API requests, not the http verb. This includes things like list and watch. For non-resource requests, this is the lowercase http verb. If '*' is present, the length of the slice must be one.

excludedUsers string[] ​

ExcludedUsers describe a list of users for which the checks will be skipped. Impersonation attempts on these users will still be subjected to the checks.