# coding=utf-8
# *** WARNING: this file was generated by pulumigen. ***
# *** Do not edit by hand unless you're certain you know what you are doing! ***

import copy
import warnings
import pulumi
import pulumi.runtime
from typing import Any, Mapping, Optional, Sequence, Union, overload
from ... import _utilities
from . import outputs
from ... import meta as _meta

__all__ = [
    'MatchResources',
    'MatchResourcesPatch',
    'NamedRuleWithOperations',
    'NamedRuleWithOperationsPatch',
    'ParamKind',
    'ParamKindPatch',
    'ParamRef',
    'ParamRefPatch',
    'ValidatingAdmissionPolicy',
    'ValidatingAdmissionPolicyBinding',
    'ValidatingAdmissionPolicyBindingSpec',
    'ValidatingAdmissionPolicyBindingSpecPatch',
    'ValidatingAdmissionPolicySpec',
    'ValidatingAdmissionPolicySpecPatch',
    'Validation',
    'ValidationPatch',
]

@pulumi.output_type
class MatchResources(dict):
    """
    MatchResources decides whether to run the admission control policy on an object based on whether it meets the match criteria. The exclude rules take precedence over include rules (if a resource matches both, it is excluded)
    """
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "excludeResourceRules":
            suggest = "exclude_resource_rules"
        elif key == "matchPolicy":
            suggest = "match_policy"
        elif key == "namespaceSelector":
            suggest = "namespace_selector"
        elif key == "objectSelector":
            suggest = "object_selector"
        elif key == "resourceRules":
            suggest = "resource_rules"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in MatchResources. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        MatchResources.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        MatchResources.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 exclude_resource_rules: Optional[Sequence['outputs.NamedRuleWithOperations']] = None,
                 match_policy: Optional[str] = None,
                 namespace_selector: Optional['_meta.v1.outputs.LabelSelector'] = None,
                 object_selector: Optional['_meta.v1.outputs.LabelSelector'] = None,
                 resource_rules: Optional[Sequence['outputs.NamedRuleWithOperations']] = None):
        """
        MatchResources decides whether to run the admission control policy on an object based on whether it meets the match criteria. The exclude rules take precedence over include rules (if a resource matches both, it is excluded)
        :param Sequence['NamedRuleWithOperationsArgs'] exclude_resource_rules: ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. The exclude rules take precedence over include rules (if a resource matches both, it is excluded)
        :param str match_policy: matchPolicy defines how the "MatchResources" list is used to match incoming requests. Allowed values are "Exact" or "Equivalent".
               
               - Exact: match a request only if it exactly matches a specified rule. For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy.
               
               - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy.
               
               Defaults to "Equivalent"
        :param '_meta.v1.LabelSelectorArgs' namespace_selector: NamespaceSelector decides whether to run the admission control policy on an object based on whether the namespace for that object matches the selector. If the object itself is a namespace, the matching is performed on object.metadata.labels. If the object is another cluster scoped resource, it never skips the policy.
               
               For example, to run the webhook on any objects whose namespace is not associated with "runlevel" of "0" or "1";  you will set the selector as follows: "namespaceSelector": {
                 "matchExpressions": [
                   {
                     "key": "runlevel",
                     "operator": "NotIn",
                     "values": [
                       "0",
                       "1"
                     ]
                   }
                 ]
               }
               
               If instead you want to only run the policy on any objects whose namespace is associated with the "environment" of "prod" or "staging"; you will set the selector as follows: "namespaceSelector": {
                 "matchExpressions": [
                   {
                     "key": "environment",
                     "operator": "In",
                     "values": [
                       "prod",
                       "staging"
                     ]
                   }
                 ]
               }
               
               See https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ for more examples of label selectors.
               
               Default to the empty LabelSelector, which matches everything.
        :param '_meta.v1.LabelSelectorArgs' object_selector: ObjectSelector decides whether to run the validation based on if the object has matching labels. objectSelector is evaluated against both the oldObject and newObject that would be sent to the cel validation, and is considered to match if either object matches the selector. A null object (oldObject in the case of create, or newObject in the case of delete) or an object that cannot have labels (like a DeploymentRollback or a PodProxyOptions object) is not considered to match. Use the object selector only if the webhook is opt-in, because end users may skip the admission webhook by setting the labels. Default to the empty LabelSelector, which matches everything.
        :param Sequence['NamedRuleWithOperationsArgs'] resource_rules: ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. The policy cares about an operation if it matches _any_ Rule.
        """
        if exclude_resource_rules is not None:
            pulumi.set(__self__, "exclude_resource_rules", exclude_resource_rules)
        if match_policy is not None:
            pulumi.set(__self__, "match_policy", match_policy)
        if namespace_selector is not None:
            pulumi.set(__self__, "namespace_selector", namespace_selector)
        if object_selector is not None:
            pulumi.set(__self__, "object_selector", object_selector)
        if resource_rules is not None:
            pulumi.set(__self__, "resource_rules", resource_rules)

    @property
    @pulumi.getter(name="excludeResourceRules")
    def exclude_resource_rules(self) -> Optional[Sequence['outputs.NamedRuleWithOperations']]:
        """
        ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. The exclude rules take precedence over include rules (if a resource matches both, it is excluded)
        """
        return pulumi.get(self, "exclude_resource_rules")

    @property
    @pulumi.getter(name="matchPolicy")
    def match_policy(self) -> Optional[str]:
        """
        matchPolicy defines how the "MatchResources" list is used to match incoming requests. Allowed values are "Exact" or "Equivalent".

        - Exact: match a request only if it exactly matches a specified rule. For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy.

        - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy.

        Defaults to "Equivalent"
        """
        return pulumi.get(self, "match_policy")

    @property
    @pulumi.getter(name="namespaceSelector")
    def namespace_selector(self) -> Optional['_meta.v1.outputs.LabelSelector']:
        """
        NamespaceSelector decides whether to run the admission control policy on an object based on whether the namespace for that object matches the selector. If the object itself is a namespace, the matching is performed on object.metadata.labels. If the object is another cluster scoped resource, it never skips the policy.

        For example, to run the webhook on any objects whose namespace is not associated with "runlevel" of "0" or "1";  you will set the selector as follows: "namespaceSelector": {
          "matchExpressions": [
            {
              "key": "runlevel",
              "operator": "NotIn",
              "values": [
                "0",
                "1"
              ]
            }
          ]
        }

        If instead you want to only run the policy on any objects whose namespace is associated with the "environment" of "prod" or "staging"; you will set the selector as follows: "namespaceSelector": {
          "matchExpressions": [
            {
              "key": "environment",
              "operator": "In",
              "values": [
                "prod",
                "staging"
              ]
            }
          ]
        }

        See https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ for more examples of label selectors.

        Default to the empty LabelSelector, which matches everything.
        """
        return pulumi.get(self, "namespace_selector")

    @property
    @pulumi.getter(name="objectSelector")
    def object_selector(self) -> Optional['_meta.v1.outputs.LabelSelector']:
        """
        ObjectSelector decides whether to run the validation based on if the object has matching labels. objectSelector is evaluated against both the oldObject and newObject that would be sent to the cel validation, and is considered to match if either object matches the selector. A null object (oldObject in the case of create, or newObject in the case of delete) or an object that cannot have labels (like a DeploymentRollback or a PodProxyOptions object) is not considered to match. Use the object selector only if the webhook is opt-in, because end users may skip the admission webhook by setting the labels. Default to the empty LabelSelector, which matches everything.
        """
        return pulumi.get(self, "object_selector")

    @property
    @pulumi.getter(name="resourceRules")
    def resource_rules(self) -> Optional[Sequence['outputs.NamedRuleWithOperations']]:
        """
        ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. The policy cares about an operation if it matches _any_ Rule.
        """
        return pulumi.get(self, "resource_rules")


@pulumi.output_type
class MatchResourcesPatch(dict):
    """
    MatchResources decides whether to run the admission control policy on an object based on whether it meets the match criteria. The exclude rules take precedence over include rules (if a resource matches both, it is excluded)
    """
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "excludeResourceRules":
            suggest = "exclude_resource_rules"
        elif key == "matchPolicy":
            suggest = "match_policy"
        elif key == "namespaceSelector":
            suggest = "namespace_selector"
        elif key == "objectSelector":
            suggest = "object_selector"
        elif key == "resourceRules":
            suggest = "resource_rules"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in MatchResourcesPatch. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        MatchResourcesPatch.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        MatchResourcesPatch.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 exclude_resource_rules: Optional[Sequence['outputs.NamedRuleWithOperationsPatch']] = None,
                 match_policy: Optional[str] = None,
                 namespace_selector: Optional['_meta.v1.outputs.LabelSelectorPatch'] = None,
                 object_selector: Optional['_meta.v1.outputs.LabelSelectorPatch'] = None,
                 resource_rules: Optional[Sequence['outputs.NamedRuleWithOperationsPatch']] = None):
        """
        MatchResources decides whether to run the admission control policy on an object based on whether it meets the match criteria. The exclude rules take precedence over include rules (if a resource matches both, it is excluded)
        :param Sequence['NamedRuleWithOperationsPatchArgs'] exclude_resource_rules: ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. The exclude rules take precedence over include rules (if a resource matches both, it is excluded)
        :param str match_policy: matchPolicy defines how the "MatchResources" list is used to match incoming requests. Allowed values are "Exact" or "Equivalent".
               
               - Exact: match a request only if it exactly matches a specified rule. For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy.
               
               - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy.
               
               Defaults to "Equivalent"
        :param '_meta.v1.LabelSelectorPatchArgs' namespace_selector: NamespaceSelector decides whether to run the admission control policy on an object based on whether the namespace for that object matches the selector. If the object itself is a namespace, the matching is performed on object.metadata.labels. If the object is another cluster scoped resource, it never skips the policy.
               
               For example, to run the webhook on any objects whose namespace is not associated with "runlevel" of "0" or "1";  you will set the selector as follows: "namespaceSelector": {
                 "matchExpressions": [
                   {
                     "key": "runlevel",
                     "operator": "NotIn",
                     "values": [
                       "0",
                       "1"
                     ]
                   }
                 ]
               }
               
               If instead you want to only run the policy on any objects whose namespace is associated with the "environment" of "prod" or "staging"; you will set the selector as follows: "namespaceSelector": {
                 "matchExpressions": [
                   {
                     "key": "environment",
                     "operator": "In",
                     "values": [
                       "prod",
                       "staging"
                     ]
                   }
                 ]
               }
               
               See https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ for more examples of label selectors.
               
               Default to the empty LabelSelector, which matches everything.
        :param '_meta.v1.LabelSelectorPatchArgs' object_selector: ObjectSelector decides whether to run the validation based on if the object has matching labels. objectSelector is evaluated against both the oldObject and newObject that would be sent to the cel validation, and is considered to match if either object matches the selector. A null object (oldObject in the case of create, or newObject in the case of delete) or an object that cannot have labels (like a DeploymentRollback or a PodProxyOptions object) is not considered to match. Use the object selector only if the webhook is opt-in, because end users may skip the admission webhook by setting the labels. Default to the empty LabelSelector, which matches everything.
        :param Sequence['NamedRuleWithOperationsPatchArgs'] resource_rules: ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. The policy cares about an operation if it matches _any_ Rule.
        """
        if exclude_resource_rules is not None:
            pulumi.set(__self__, "exclude_resource_rules", exclude_resource_rules)
        if match_policy is not None:
            pulumi.set(__self__, "match_policy", match_policy)
        if namespace_selector is not None:
            pulumi.set(__self__, "namespace_selector", namespace_selector)
        if object_selector is not None:
            pulumi.set(__self__, "object_selector", object_selector)
        if resource_rules is not None:
            pulumi.set(__self__, "resource_rules", resource_rules)

    @property
    @pulumi.getter(name="excludeResourceRules")
    def exclude_resource_rules(self) -> Optional[Sequence['outputs.NamedRuleWithOperationsPatch']]:
        """
        ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. The exclude rules take precedence over include rules (if a resource matches both, it is excluded)
        """
        return pulumi.get(self, "exclude_resource_rules")

    @property
    @pulumi.getter(name="matchPolicy")
    def match_policy(self) -> Optional[str]:
        """
        matchPolicy defines how the "MatchResources" list is used to match incoming requests. Allowed values are "Exact" or "Equivalent".

        - Exact: match a request only if it exactly matches a specified rule. For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy.

        - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy.

        Defaults to "Equivalent"
        """
        return pulumi.get(self, "match_policy")

    @property
    @pulumi.getter(name="namespaceSelector")
    def namespace_selector(self) -> Optional['_meta.v1.outputs.LabelSelectorPatch']:
        """
        NamespaceSelector decides whether to run the admission control policy on an object based on whether the namespace for that object matches the selector. If the object itself is a namespace, the matching is performed on object.metadata.labels. If the object is another cluster scoped resource, it never skips the policy.

        For example, to run the webhook on any objects whose namespace is not associated with "runlevel" of "0" or "1";  you will set the selector as follows: "namespaceSelector": {
          "matchExpressions": [
            {
              "key": "runlevel",
              "operator": "NotIn",
              "values": [
                "0",
                "1"
              ]
            }
          ]
        }

        If instead you want to only run the policy on any objects whose namespace is associated with the "environment" of "prod" or "staging"; you will set the selector as follows: "namespaceSelector": {
          "matchExpressions": [
            {
              "key": "environment",
              "operator": "In",
              "values": [
                "prod",
                "staging"
              ]
            }
          ]
        }

        See https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ for more examples of label selectors.

        Default to the empty LabelSelector, which matches everything.
        """
        return pulumi.get(self, "namespace_selector")

    @property
    @pulumi.getter(name="objectSelector")
    def object_selector(self) -> Optional['_meta.v1.outputs.LabelSelectorPatch']:
        """
        ObjectSelector decides whether to run the validation based on if the object has matching labels. objectSelector is evaluated against both the oldObject and newObject that would be sent to the cel validation, and is considered to match if either object matches the selector. A null object (oldObject in the case of create, or newObject in the case of delete) or an object that cannot have labels (like a DeploymentRollback or a PodProxyOptions object) is not considered to match. Use the object selector only if the webhook is opt-in, because end users may skip the admission webhook by setting the labels. Default to the empty LabelSelector, which matches everything.
        """
        return pulumi.get(self, "object_selector")

    @property
    @pulumi.getter(name="resourceRules")
    def resource_rules(self) -> Optional[Sequence['outputs.NamedRuleWithOperationsPatch']]:
        """
        ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. The policy cares about an operation if it matches _any_ Rule.
        """
        return pulumi.get(self, "resource_rules")


@pulumi.output_type
class NamedRuleWithOperations(dict):
    """
    NamedRuleWithOperations is a tuple of Operations and Resources with ResourceNames.
    """
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "apiGroups":
            suggest = "api_groups"
        elif key == "apiVersions":
            suggest = "api_versions"
        elif key == "resourceNames":
            suggest = "resource_names"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in NamedRuleWithOperations. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        NamedRuleWithOperations.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        NamedRuleWithOperations.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 api_groups: Optional[Sequence[str]] = None,
                 api_versions: Optional[Sequence[str]] = None,
                 operations: Optional[Sequence[str]] = None,
                 resource_names: Optional[Sequence[str]] = None,
                 resources: Optional[Sequence[str]] = None,
                 scope: Optional[str] = None):
        """
        NamedRuleWithOperations is a tuple of Operations and Resources with ResourceNames.
        :param Sequence[str] api_groups: APIGroups is the API groups the resources belong to. '*' is all groups. If '*' is present, the length of the slice must be one. Required.
        :param Sequence[str] api_versions: APIVersions is the API versions the resources belong to. '*' is all versions. If '*' is present, the length of the slice must be one. Required.
        :param Sequence[str] operations: Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * for all of those operations and any future admission operations that are added. If '*' is present, the length of the slice must be one. Required.
        :param Sequence[str] resource_names: ResourceNames is an optional white list of names that the rule applies to.  An empty set means that everything is allowed.
        :param Sequence[str] resources: Resources is a list of resources this rule applies to.
               
               For example: 'pods' means pods. 'pods/log' means the log subresource of pods. '*' means all resources, but not subresources. 'pods/*' means all subresources of pods. '*/scale' means all scale subresources. '*/*' means all resources and their subresources.
               
               If wildcard is present, the validation rule will ensure resources do not overlap with each other.
               
               Depending on the enclosing object, subresources might not be allowed. Required.
        :param str scope: scope specifies the scope of this rule. Valid values are "Cluster", "Namespaced", and "*" "Cluster" means that only cluster-scoped resources will match this rule. Namespace API objects are cluster-scoped. "Namespaced" means that only namespaced resources will match this rule. "*" means that there are no scope restrictions. Subresources match the scope of their parent resource. Default is "*".
        """
        if api_groups is not None:
            pulumi.set(__self__, "api_groups", api_groups)
        if api_versions is not None:
            pulumi.set(__self__, "api_versions", api_versions)
        if operations is not None:
            pulumi.set(__self__, "operations", operations)
        if resource_names is not None:
            pulumi.set(__self__, "resource_names", resource_names)
        if resources is not None:
            pulumi.set(__self__, "resources", resources)
        if scope is not None:
            pulumi.set(__self__, "scope", scope)

    @property
    @pulumi.getter(name="apiGroups")
    def api_groups(self) -> Optional[Sequence[str]]:
        """
        APIGroups is the API groups the resources belong to. '*' is all groups. If '*' is present, the length of the slice must be one. Required.
        """
        return pulumi.get(self, "api_groups")

    @property
    @pulumi.getter(name="apiVersions")
    def api_versions(self) -> Optional[Sequence[str]]:
        """
        APIVersions is the API versions the resources belong to. '*' is all versions. If '*' is present, the length of the slice must be one. Required.
        """
        return pulumi.get(self, "api_versions")

    @property
    @pulumi.getter
    def operations(self) -> Optional[Sequence[str]]:
        """
        Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * for all of those operations and any future admission operations that are added. If '*' is present, the length of the slice must be one. Required.
        """
        return pulumi.get(self, "operations")

    @property
    @pulumi.getter(name="resourceNames")
    def resource_names(self) -> Optional[Sequence[str]]:
        """
        ResourceNames is an optional white list of names that the rule applies to.  An empty set means that everything is allowed.
        """
        return pulumi.get(self, "resource_names")

    @property
    @pulumi.getter
    def resources(self) -> Optional[Sequence[str]]:
        """
        Resources is a list of resources this rule applies to.

        For example: 'pods' means pods. 'pods/log' means the log subresource of pods. '*' means all resources, but not subresources. 'pods/*' means all subresources of pods. '*/scale' means all scale subresources. '*/*' means all resources and their subresources.

        If wildcard is present, the validation rule will ensure resources do not overlap with each other.

        Depending on the enclosing object, subresources might not be allowed. Required.
        """
        return pulumi.get(self, "resources")

    @property
    @pulumi.getter
    def scope(self) -> Optional[str]:
        """
        scope specifies the scope of this rule. Valid values are "Cluster", "Namespaced", and "*" "Cluster" means that only cluster-scoped resources will match this rule. Namespace API objects are cluster-scoped. "Namespaced" means that only namespaced resources will match this rule. "*" means that there are no scope restrictions. Subresources match the scope of their parent resource. Default is "*".
        """
        return pulumi.get(self, "scope")


@pulumi.output_type
class NamedRuleWithOperationsPatch(dict):
    """
    NamedRuleWithOperations is a tuple of Operations and Resources with ResourceNames.
    """
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "apiGroups":
            suggest = "api_groups"
        elif key == "apiVersions":
            suggest = "api_versions"
        elif key == "resourceNames":
            suggest = "resource_names"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in NamedRuleWithOperationsPatch. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        NamedRuleWithOperationsPatch.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        NamedRuleWithOperationsPatch.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 api_groups: Optional[Sequence[str]] = None,
                 api_versions: Optional[Sequence[str]] = None,
                 operations: Optional[Sequence[str]] = None,
                 resource_names: Optional[Sequence[str]] = None,
                 resources: Optional[Sequence[str]] = None,
                 scope: Optional[str] = None):
        """
        NamedRuleWithOperations is a tuple of Operations and Resources with ResourceNames.
        :param Sequence[str] api_groups: APIGroups is the API groups the resources belong to. '*' is all groups. If '*' is present, the length of the slice must be one. Required.
        :param Sequence[str] api_versions: APIVersions is the API versions the resources belong to. '*' is all versions. If '*' is present, the length of the slice must be one. Required.
        :param Sequence[str] operations: Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * for all of those operations and any future admission operations that are added. If '*' is present, the length of the slice must be one. Required.
        :param Sequence[str] resource_names: ResourceNames is an optional white list of names that the rule applies to.  An empty set means that everything is allowed.
        :param Sequence[str] resources: Resources is a list of resources this rule applies to.
               
               For example: 'pods' means pods. 'pods/log' means the log subresource of pods. '*' means all resources, but not subresources. 'pods/*' means all subresources of pods. '*/scale' means all scale subresources. '*/*' means all resources and their subresources.
               
               If wildcard is present, the validation rule will ensure resources do not overlap with each other.
               
               Depending on the enclosing object, subresources might not be allowed. Required.
        :param str scope: scope specifies the scope of this rule. Valid values are "Cluster", "Namespaced", and "*" "Cluster" means that only cluster-scoped resources will match this rule. Namespace API objects are cluster-scoped. "Namespaced" means that only namespaced resources will match this rule. "*" means that there are no scope restrictions. Subresources match the scope of their parent resource. Default is "*".
        """
        if api_groups is not None:
            pulumi.set(__self__, "api_groups", api_groups)
        if api_versions is not None:
            pulumi.set(__self__, "api_versions", api_versions)
        if operations is not None:
            pulumi.set(__self__, "operations", operations)
        if resource_names is not None:
            pulumi.set(__self__, "resource_names", resource_names)
        if resources is not None:
            pulumi.set(__self__, "resources", resources)
        if scope is not None:
            pulumi.set(__self__, "scope", scope)

    @property
    @pulumi.getter(name="apiGroups")
    def api_groups(self) -> Optional[Sequence[str]]:
        """
        APIGroups is the API groups the resources belong to. '*' is all groups. If '*' is present, the length of the slice must be one. Required.
        """
        return pulumi.get(self, "api_groups")

    @property
    @pulumi.getter(name="apiVersions")
    def api_versions(self) -> Optional[Sequence[str]]:
        """
        APIVersions is the API versions the resources belong to. '*' is all versions. If '*' is present, the length of the slice must be one. Required.
        """
        return pulumi.get(self, "api_versions")

    @property
    @pulumi.getter
    def operations(self) -> Optional[Sequence[str]]:
        """
        Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * for all of those operations and any future admission operations that are added. If '*' is present, the length of the slice must be one. Required.
        """
        return pulumi.get(self, "operations")

    @property
    @pulumi.getter(name="resourceNames")
    def resource_names(self) -> Optional[Sequence[str]]:
        """
        ResourceNames is an optional white list of names that the rule applies to.  An empty set means that everything is allowed.
        """
        return pulumi.get(self, "resource_names")

    @property
    @pulumi.getter
    def resources(self) -> Optional[Sequence[str]]:
        """
        Resources is a list of resources this rule applies to.

        For example: 'pods' means pods. 'pods/log' means the log subresource of pods. '*' means all resources, but not subresources. 'pods/*' means all subresources of pods. '*/scale' means all scale subresources. '*/*' means all resources and their subresources.

        If wildcard is present, the validation rule will ensure resources do not overlap with each other.

        Depending on the enclosing object, subresources might not be allowed. Required.
        """
        return pulumi.get(self, "resources")

    @property
    @pulumi.getter
    def scope(self) -> Optional[str]:
        """
        scope specifies the scope of this rule. Valid values are "Cluster", "Namespaced", and "*" "Cluster" means that only cluster-scoped resources will match this rule. Namespace API objects are cluster-scoped. "Namespaced" means that only namespaced resources will match this rule. "*" means that there are no scope restrictions. Subresources match the scope of their parent resource. Default is "*".
        """
        return pulumi.get(self, "scope")


@pulumi.output_type
class ParamKind(dict):
    """
    ParamKind is a tuple of Group Kind and Version.
    """
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "apiVersion":
            suggest = "api_version"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in ParamKind. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        ParamKind.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        ParamKind.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 api_version: Optional[str] = None,
                 kind: Optional[str] = None):
        """
        ParamKind is a tuple of Group Kind and Version.
        :param str api_version: APIVersion is the API group version the resources belong to. In format of "group/version". Required.
        :param str kind: Kind is the API kind the resources belong to. Required.
        """
        if api_version is not None:
            pulumi.set(__self__, "api_version", api_version)
        if kind is not None:
            pulumi.set(__self__, "kind", kind)

    @property
    @pulumi.getter(name="apiVersion")
    def api_version(self) -> Optional[str]:
        """
        APIVersion is the API group version the resources belong to. In format of "group/version". Required.
        """
        return pulumi.get(self, "api_version")

    @property
    @pulumi.getter
    def kind(self) -> Optional[str]:
        """
        Kind is the API kind the resources belong to. Required.
        """
        return pulumi.get(self, "kind")


@pulumi.output_type
class ParamKindPatch(dict):
    """
    ParamKind is a tuple of Group Kind and Version.
    """
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "apiVersion":
            suggest = "api_version"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in ParamKindPatch. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        ParamKindPatch.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        ParamKindPatch.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 api_version: Optional[str] = None,
                 kind: Optional[str] = None):
        """
        ParamKind is a tuple of Group Kind and Version.
        :param str api_version: APIVersion is the API group version the resources belong to. In format of "group/version". Required.
        :param str kind: Kind is the API kind the resources belong to. Required.
        """
        if api_version is not None:
            pulumi.set(__self__, "api_version", api_version)
        if kind is not None:
            pulumi.set(__self__, "kind", kind)

    @property
    @pulumi.getter(name="apiVersion")
    def api_version(self) -> Optional[str]:
        """
        APIVersion is the API group version the resources belong to. In format of "group/version". Required.
        """
        return pulumi.get(self, "api_version")

    @property
    @pulumi.getter
    def kind(self) -> Optional[str]:
        """
        Kind is the API kind the resources belong to. Required.
        """
        return pulumi.get(self, "kind")


@pulumi.output_type
class ParamRef(dict):
    """
    ParamRef references a parameter resource
    """
    def __init__(__self__, *,
                 name: Optional[str] = None,
                 namespace: Optional[str] = None):
        """
        ParamRef references a parameter resource
        :param str name: Name of the resource being referenced.
        :param str namespace: Namespace of the referenced resource. Should be empty for the cluster-scoped resources
        """
        if name is not None:
            pulumi.set(__self__, "name", name)
        if namespace is not None:
            pulumi.set(__self__, "namespace", namespace)

    @property
    @pulumi.getter
    def name(self) -> Optional[str]:
        """
        Name of the resource being referenced.
        """
        return pulumi.get(self, "name")

    @property
    @pulumi.getter
    def namespace(self) -> Optional[str]:
        """
        Namespace of the referenced resource. Should be empty for the cluster-scoped resources
        """
        return pulumi.get(self, "namespace")


@pulumi.output_type
class ParamRefPatch(dict):
    """
    ParamRef references a parameter resource
    """
    def __init__(__self__, *,
                 name: Optional[str] = None,
                 namespace: Optional[str] = None):
        """
        ParamRef references a parameter resource
        :param str name: Name of the resource being referenced.
        :param str namespace: Namespace of the referenced resource. Should be empty for the cluster-scoped resources
        """
        if name is not None:
            pulumi.set(__self__, "name", name)
        if namespace is not None:
            pulumi.set(__self__, "namespace", namespace)

    @property
    @pulumi.getter
    def name(self) -> Optional[str]:
        """
        Name of the resource being referenced.
        """
        return pulumi.get(self, "name")

    @property
    @pulumi.getter
    def namespace(self) -> Optional[str]:
        """
        Namespace of the referenced resource. Should be empty for the cluster-scoped resources
        """
        return pulumi.get(self, "namespace")


@pulumi.output_type
class ValidatingAdmissionPolicy(dict):
    """
    ValidatingAdmissionPolicy describes the definition of an admission validation policy that accepts or rejects an object without changing it.
    """
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "apiVersion":
            suggest = "api_version"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in ValidatingAdmissionPolicy. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        ValidatingAdmissionPolicy.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        ValidatingAdmissionPolicy.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 api_version: Optional[str] = None,
                 kind: Optional[str] = None,
                 metadata: Optional['_meta.v1.outputs.ObjectMeta'] = None,
                 spec: Optional['outputs.ValidatingAdmissionPolicySpec'] = None):
        """
        ValidatingAdmissionPolicy describes the definition of an admission validation policy that accepts or rejects an object without changing it.
        :param str api_version: APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
        :param str kind: Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
        :param '_meta.v1.ObjectMetaArgs' metadata: Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
        :param 'ValidatingAdmissionPolicySpecArgs' spec: Specification of the desired behavior of the ValidatingAdmissionPolicy.
        """
        if api_version is not None:
            pulumi.set(__self__, "api_version", 'admissionregistration.k8s.io/v1alpha1')
        if kind is not None:
            pulumi.set(__self__, "kind", 'ValidatingAdmissionPolicy')
        if metadata is not None:
            pulumi.set(__self__, "metadata", metadata)
        if spec is not None:
            pulumi.set(__self__, "spec", spec)

    @property
    @pulumi.getter(name="apiVersion")
    def api_version(self) -> Optional[str]:
        """
        APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
        """
        return pulumi.get(self, "api_version")

    @property
    @pulumi.getter
    def kind(self) -> Optional[str]:
        """
        Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
        """
        return pulumi.get(self, "kind")

    @property
    @pulumi.getter
    def metadata(self) -> Optional['_meta.v1.outputs.ObjectMeta']:
        """
        Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
        """
        return pulumi.get(self, "metadata")

    @property
    @pulumi.getter
    def spec(self) -> Optional['outputs.ValidatingAdmissionPolicySpec']:
        """
        Specification of the desired behavior of the ValidatingAdmissionPolicy.
        """
        return pulumi.get(self, "spec")


@pulumi.output_type
class ValidatingAdmissionPolicyBinding(dict):
    """
    ValidatingAdmissionPolicyBinding binds the ValidatingAdmissionPolicy with paramerized resources. ValidatingAdmissionPolicyBinding and parameter CRDs together define how cluster administrators configure policies for clusters.
    """
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "apiVersion":
            suggest = "api_version"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in ValidatingAdmissionPolicyBinding. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        ValidatingAdmissionPolicyBinding.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        ValidatingAdmissionPolicyBinding.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 api_version: Optional[str] = None,
                 kind: Optional[str] = None,
                 metadata: Optional['_meta.v1.outputs.ObjectMeta'] = None,
                 spec: Optional['outputs.ValidatingAdmissionPolicyBindingSpec'] = None):
        """
        ValidatingAdmissionPolicyBinding binds the ValidatingAdmissionPolicy with paramerized resources. ValidatingAdmissionPolicyBinding and parameter CRDs together define how cluster administrators configure policies for clusters.
        :param str api_version: APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
        :param str kind: Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
        :param '_meta.v1.ObjectMetaArgs' metadata: Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
        :param 'ValidatingAdmissionPolicyBindingSpecArgs' spec: Specification of the desired behavior of the ValidatingAdmissionPolicyBinding.
        """
        if api_version is not None:
            pulumi.set(__self__, "api_version", 'admissionregistration.k8s.io/v1alpha1')
        if kind is not None:
            pulumi.set(__self__, "kind", 'ValidatingAdmissionPolicyBinding')
        if metadata is not None:
            pulumi.set(__self__, "metadata", metadata)
        if spec is not None:
            pulumi.set(__self__, "spec", spec)

    @property
    @pulumi.getter(name="apiVersion")
    def api_version(self) -> Optional[str]:
        """
        APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
        """
        return pulumi.get(self, "api_version")

    @property
    @pulumi.getter
    def kind(self) -> Optional[str]:
        """
        Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
        """
        return pulumi.get(self, "kind")

    @property
    @pulumi.getter
    def metadata(self) -> Optional['_meta.v1.outputs.ObjectMeta']:
        """
        Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
        """
        return pulumi.get(self, "metadata")

    @property
    @pulumi.getter
    def spec(self) -> Optional['outputs.ValidatingAdmissionPolicyBindingSpec']:
        """
        Specification of the desired behavior of the ValidatingAdmissionPolicyBinding.
        """
        return pulumi.get(self, "spec")


@pulumi.output_type
class ValidatingAdmissionPolicyBindingSpec(dict):
    """
    ValidatingAdmissionPolicyBindingSpec is the specification of the ValidatingAdmissionPolicyBinding.
    """
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "matchResources":
            suggest = "match_resources"
        elif key == "paramRef":
            suggest = "param_ref"
        elif key == "policyName":
            suggest = "policy_name"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in ValidatingAdmissionPolicyBindingSpec. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        ValidatingAdmissionPolicyBindingSpec.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        ValidatingAdmissionPolicyBindingSpec.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 match_resources: Optional['outputs.MatchResources'] = None,
                 param_ref: Optional['outputs.ParamRef'] = None,
                 policy_name: Optional[str] = None):
        """
        ValidatingAdmissionPolicyBindingSpec is the specification of the ValidatingAdmissionPolicyBinding.
        :param 'MatchResourcesArgs' match_resources: MatchResources declares what resources match this binding and will be validated by it. Note that this is intersected with the policy's matchConstraints, so only requests that are matched by the policy can be selected by this. If this is unset, all resources matched by the policy are validated by this binding When resourceRules is unset, it does not constrain resource matching. If a resource is matched by the other fields of this object, it will be validated. Note that this is differs from ValidatingAdmissionPolicy matchConstraints, where resourceRules are required.
        :param 'ParamRefArgs' param_ref: ParamRef specifies the parameter resource used to configure the admission control policy. It should point to a resource of the type specified in ParamKind of the bound ValidatingAdmissionPolicy. If the policy specifies a ParamKind and the resource referred to by ParamRef does not exist, this binding is considered mis-configured and the FailurePolicy of the ValidatingAdmissionPolicy applied.
        :param str policy_name: PolicyName references a ValidatingAdmissionPolicy name which the ValidatingAdmissionPolicyBinding binds to. If the referenced resource does not exist, this binding is considered invalid and will be ignored Required.
        """
        if match_resources is not None:
            pulumi.set(__self__, "match_resources", match_resources)
        if param_ref is not None:
            pulumi.set(__self__, "param_ref", param_ref)
        if policy_name is not None:
            pulumi.set(__self__, "policy_name", policy_name)

    @property
    @pulumi.getter(name="matchResources")
    def match_resources(self) -> Optional['outputs.MatchResources']:
        """
        MatchResources declares what resources match this binding and will be validated by it. Note that this is intersected with the policy's matchConstraints, so only requests that are matched by the policy can be selected by this. If this is unset, all resources matched by the policy are validated by this binding When resourceRules is unset, it does not constrain resource matching. If a resource is matched by the other fields of this object, it will be validated. Note that this is differs from ValidatingAdmissionPolicy matchConstraints, where resourceRules are required.
        """
        return pulumi.get(self, "match_resources")

    @property
    @pulumi.getter(name="paramRef")
    def param_ref(self) -> Optional['outputs.ParamRef']:
        """
        ParamRef specifies the parameter resource used to configure the admission control policy. It should point to a resource of the type specified in ParamKind of the bound ValidatingAdmissionPolicy. If the policy specifies a ParamKind and the resource referred to by ParamRef does not exist, this binding is considered mis-configured and the FailurePolicy of the ValidatingAdmissionPolicy applied.
        """
        return pulumi.get(self, "param_ref")

    @property
    @pulumi.getter(name="policyName")
    def policy_name(self) -> Optional[str]:
        """
        PolicyName references a ValidatingAdmissionPolicy name which the ValidatingAdmissionPolicyBinding binds to. If the referenced resource does not exist, this binding is considered invalid and will be ignored Required.
        """
        return pulumi.get(self, "policy_name")


@pulumi.output_type
class ValidatingAdmissionPolicyBindingSpecPatch(dict):
    """
    ValidatingAdmissionPolicyBindingSpec is the specification of the ValidatingAdmissionPolicyBinding.
    """
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "matchResources":
            suggest = "match_resources"
        elif key == "paramRef":
            suggest = "param_ref"
        elif key == "policyName":
            suggest = "policy_name"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in ValidatingAdmissionPolicyBindingSpecPatch. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        ValidatingAdmissionPolicyBindingSpecPatch.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        ValidatingAdmissionPolicyBindingSpecPatch.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 match_resources: Optional['outputs.MatchResourcesPatch'] = None,
                 param_ref: Optional['outputs.ParamRefPatch'] = None,
                 policy_name: Optional[str] = None):
        """
        ValidatingAdmissionPolicyBindingSpec is the specification of the ValidatingAdmissionPolicyBinding.
        :param 'MatchResourcesPatchArgs' match_resources: MatchResources declares what resources match this binding and will be validated by it. Note that this is intersected with the policy's matchConstraints, so only requests that are matched by the policy can be selected by this. If this is unset, all resources matched by the policy are validated by this binding When resourceRules is unset, it does not constrain resource matching. If a resource is matched by the other fields of this object, it will be validated. Note that this is differs from ValidatingAdmissionPolicy matchConstraints, where resourceRules are required.
        :param 'ParamRefPatchArgs' param_ref: ParamRef specifies the parameter resource used to configure the admission control policy. It should point to a resource of the type specified in ParamKind of the bound ValidatingAdmissionPolicy. If the policy specifies a ParamKind and the resource referred to by ParamRef does not exist, this binding is considered mis-configured and the FailurePolicy of the ValidatingAdmissionPolicy applied.
        :param str policy_name: PolicyName references a ValidatingAdmissionPolicy name which the ValidatingAdmissionPolicyBinding binds to. If the referenced resource does not exist, this binding is considered invalid and will be ignored Required.
        """
        if match_resources is not None:
            pulumi.set(__self__, "match_resources", match_resources)
        if param_ref is not None:
            pulumi.set(__self__, "param_ref", param_ref)
        if policy_name is not None:
            pulumi.set(__self__, "policy_name", policy_name)

    @property
    @pulumi.getter(name="matchResources")
    def match_resources(self) -> Optional['outputs.MatchResourcesPatch']:
        """
        MatchResources declares what resources match this binding and will be validated by it. Note that this is intersected with the policy's matchConstraints, so only requests that are matched by the policy can be selected by this. If this is unset, all resources matched by the policy are validated by this binding When resourceRules is unset, it does not constrain resource matching. If a resource is matched by the other fields of this object, it will be validated. Note that this is differs from ValidatingAdmissionPolicy matchConstraints, where resourceRules are required.
        """
        return pulumi.get(self, "match_resources")

    @property
    @pulumi.getter(name="paramRef")
    def param_ref(self) -> Optional['outputs.ParamRefPatch']:
        """
        ParamRef specifies the parameter resource used to configure the admission control policy. It should point to a resource of the type specified in ParamKind of the bound ValidatingAdmissionPolicy. If the policy specifies a ParamKind and the resource referred to by ParamRef does not exist, this binding is considered mis-configured and the FailurePolicy of the ValidatingAdmissionPolicy applied.
        """
        return pulumi.get(self, "param_ref")

    @property
    @pulumi.getter(name="policyName")
    def policy_name(self) -> Optional[str]:
        """
        PolicyName references a ValidatingAdmissionPolicy name which the ValidatingAdmissionPolicyBinding binds to. If the referenced resource does not exist, this binding is considered invalid and will be ignored Required.
        """
        return pulumi.get(self, "policy_name")


@pulumi.output_type
class ValidatingAdmissionPolicySpec(dict):
    """
    ValidatingAdmissionPolicySpec is the specification of the desired behavior of the AdmissionPolicy.
    """
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "failurePolicy":
            suggest = "failure_policy"
        elif key == "matchConstraints":
            suggest = "match_constraints"
        elif key == "paramKind":
            suggest = "param_kind"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in ValidatingAdmissionPolicySpec. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        ValidatingAdmissionPolicySpec.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        ValidatingAdmissionPolicySpec.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 validations: Sequence['outputs.Validation'],
                 failure_policy: Optional[str] = None,
                 match_constraints: Optional['outputs.MatchResources'] = None,
                 param_kind: Optional['outputs.ParamKind'] = None):
        """
        ValidatingAdmissionPolicySpec is the specification of the desired behavior of the AdmissionPolicy.
        :param Sequence['ValidationArgs'] validations: Validations contain CEL expressions which is used to apply the validation. A minimum of one validation is required for a policy definition. Required.
        :param str failure_policy: FailurePolicy defines how to handle failures for the admission policy. Failures can occur from invalid or mis-configured policy definitions or bindings. A policy is invalid if spec.paramKind refers to a non-existent Kind. A binding is invalid if spec.paramRef.name refers to a non-existent resource. Allowed values are Ignore or Fail. Defaults to Fail.
        :param 'MatchResourcesArgs' match_constraints: MatchConstraints specifies what resources this policy is designed to validate. The AdmissionPolicy cares about a request if it matches _all_ Constraints. However, in order to prevent clusters from being put into an unstable state that cannot be recovered from via the API ValidatingAdmissionPolicy cannot match ValidatingAdmissionPolicy and ValidatingAdmissionPolicyBinding. Required.
        :param 'ParamKindArgs' param_kind: ParamKind specifies the kind of resources used to parameterize this policy. If absent, there are no parameters for this policy and the param CEL variable will not be provided to validation expressions. If ParamKind refers to a non-existent kind, this policy definition is mis-configured and the FailurePolicy is applied. If paramKind is specified but paramRef is unset in ValidatingAdmissionPolicyBinding, the params variable will be null.
        """
        pulumi.set(__self__, "validations", validations)
        if failure_policy is not None:
            pulumi.set(__self__, "failure_policy", failure_policy)
        if match_constraints is not None:
            pulumi.set(__self__, "match_constraints", match_constraints)
        if param_kind is not None:
            pulumi.set(__self__, "param_kind", param_kind)

    @property
    @pulumi.getter
    def validations(self) -> Sequence['outputs.Validation']:
        """
        Validations contain CEL expressions which is used to apply the validation. A minimum of one validation is required for a policy definition. Required.
        """
        return pulumi.get(self, "validations")

    @property
    @pulumi.getter(name="failurePolicy")
    def failure_policy(self) -> Optional[str]:
        """
        FailurePolicy defines how to handle failures for the admission policy. Failures can occur from invalid or mis-configured policy definitions or bindings. A policy is invalid if spec.paramKind refers to a non-existent Kind. A binding is invalid if spec.paramRef.name refers to a non-existent resource. Allowed values are Ignore or Fail. Defaults to Fail.
        """
        return pulumi.get(self, "failure_policy")

    @property
    @pulumi.getter(name="matchConstraints")
    def match_constraints(self) -> Optional['outputs.MatchResources']:
        """
        MatchConstraints specifies what resources this policy is designed to validate. The AdmissionPolicy cares about a request if it matches _all_ Constraints. However, in order to prevent clusters from being put into an unstable state that cannot be recovered from via the API ValidatingAdmissionPolicy cannot match ValidatingAdmissionPolicy and ValidatingAdmissionPolicyBinding. Required.
        """
        return pulumi.get(self, "match_constraints")

    @property
    @pulumi.getter(name="paramKind")
    def param_kind(self) -> Optional['outputs.ParamKind']:
        """
        ParamKind specifies the kind of resources used to parameterize this policy. If absent, there are no parameters for this policy and the param CEL variable will not be provided to validation expressions. If ParamKind refers to a non-existent kind, this policy definition is mis-configured and the FailurePolicy is applied. If paramKind is specified but paramRef is unset in ValidatingAdmissionPolicyBinding, the params variable will be null.
        """
        return pulumi.get(self, "param_kind")


@pulumi.output_type
class ValidatingAdmissionPolicySpecPatch(dict):
    """
    ValidatingAdmissionPolicySpec is the specification of the desired behavior of the AdmissionPolicy.
    """
    @staticmethod
    def __key_warning(key: str):
        suggest = None
        if key == "failurePolicy":
            suggest = "failure_policy"
        elif key == "matchConstraints":
            suggest = "match_constraints"
        elif key == "paramKind":
            suggest = "param_kind"

        if suggest:
            pulumi.log.warn(f"Key '{key}' not found in ValidatingAdmissionPolicySpecPatch. Access the value via the '{suggest}' property getter instead.")

    def __getitem__(self, key: str) -> Any:
        ValidatingAdmissionPolicySpecPatch.__key_warning(key)
        return super().__getitem__(key)

    def get(self, key: str, default = None) -> Any:
        ValidatingAdmissionPolicySpecPatch.__key_warning(key)
        return super().get(key, default)

    def __init__(__self__, *,
                 failure_policy: Optional[str] = None,
                 match_constraints: Optional['outputs.MatchResourcesPatch'] = None,
                 param_kind: Optional['outputs.ParamKindPatch'] = None,
                 validations: Optional[Sequence['outputs.ValidationPatch']] = None):
        """
        ValidatingAdmissionPolicySpec is the specification of the desired behavior of the AdmissionPolicy.
        :param str failure_policy: FailurePolicy defines how to handle failures for the admission policy. Failures can occur from invalid or mis-configured policy definitions or bindings. A policy is invalid if spec.paramKind refers to a non-existent Kind. A binding is invalid if spec.paramRef.name refers to a non-existent resource. Allowed values are Ignore or Fail. Defaults to Fail.
        :param 'MatchResourcesPatchArgs' match_constraints: MatchConstraints specifies what resources this policy is designed to validate. The AdmissionPolicy cares about a request if it matches _all_ Constraints. However, in order to prevent clusters from being put into an unstable state that cannot be recovered from via the API ValidatingAdmissionPolicy cannot match ValidatingAdmissionPolicy and ValidatingAdmissionPolicyBinding. Required.
        :param 'ParamKindPatchArgs' param_kind: ParamKind specifies the kind of resources used to parameterize this policy. If absent, there are no parameters for this policy and the param CEL variable will not be provided to validation expressions. If ParamKind refers to a non-existent kind, this policy definition is mis-configured and the FailurePolicy is applied. If paramKind is specified but paramRef is unset in ValidatingAdmissionPolicyBinding, the params variable will be null.
        :param Sequence['ValidationPatchArgs'] validations: Validations contain CEL expressions which is used to apply the validation. A minimum of one validation is required for a policy definition. Required.
        """
        if failure_policy is not None:
            pulumi.set(__self__, "failure_policy", failure_policy)
        if match_constraints is not None:
            pulumi.set(__self__, "match_constraints", match_constraints)
        if param_kind is not None:
            pulumi.set(__self__, "param_kind", param_kind)
        if validations is not None:
            pulumi.set(__self__, "validations", validations)

    @property
    @pulumi.getter(name="failurePolicy")
    def failure_policy(self) -> Optional[str]:
        """
        FailurePolicy defines how to handle failures for the admission policy. Failures can occur from invalid or mis-configured policy definitions or bindings. A policy is invalid if spec.paramKind refers to a non-existent Kind. A binding is invalid if spec.paramRef.name refers to a non-existent resource. Allowed values are Ignore or Fail. Defaults to Fail.
        """
        return pulumi.get(self, "failure_policy")

    @property
    @pulumi.getter(name="matchConstraints")
    def match_constraints(self) -> Optional['outputs.MatchResourcesPatch']:
        """
        MatchConstraints specifies what resources this policy is designed to validate. The AdmissionPolicy cares about a request if it matches _all_ Constraints. However, in order to prevent clusters from being put into an unstable state that cannot be recovered from via the API ValidatingAdmissionPolicy cannot match ValidatingAdmissionPolicy and ValidatingAdmissionPolicyBinding. Required.
        """
        return pulumi.get(self, "match_constraints")

    @property
    @pulumi.getter(name="paramKind")
    def param_kind(self) -> Optional['outputs.ParamKindPatch']:
        """
        ParamKind specifies the kind of resources used to parameterize this policy. If absent, there are no parameters for this policy and the param CEL variable will not be provided to validation expressions. If ParamKind refers to a non-existent kind, this policy definition is mis-configured and the FailurePolicy is applied. If paramKind is specified but paramRef is unset in ValidatingAdmissionPolicyBinding, the params variable will be null.
        """
        return pulumi.get(self, "param_kind")

    @property
    @pulumi.getter
    def validations(self) -> Optional[Sequence['outputs.ValidationPatch']]:
        """
        Validations contain CEL expressions which is used to apply the validation. A minimum of one validation is required for a policy definition. Required.
        """
        return pulumi.get(self, "validations")


@pulumi.output_type
class Validation(dict):
    """
    Validation specifies the CEL expression which is used to apply the validation.
    """
    def __init__(__self__, *,
                 expression: str,
                 message: Optional[str] = None,
                 reason: Optional[str] = None):
        """
        Validation specifies the CEL expression which is used to apply the validation.
        :param str expression: Expression represents the expression which will be evaluated by CEL. ref: https://github.com/google/cel-spec CEL expressions have access to the contents of the Admission request/response, organized into CEL variables as well as some other useful variables:
               
               'object' - The object from the incoming request. The value is null for DELETE requests. 'oldObject' - The existing object. The value is null for CREATE requests. 'request' - Attributes of the admission request([ref](/pkg/apis/admission/types.go#AdmissionRequest)). 'params' - Parameter resource referred to by the policy binding being evaluated. Only populated if the policy has a ParamKind.
               
               The `apiVersion`, `kind`, `metadata.name` and `metadata.generateName` are always accessible from the root of the object. No other metadata properties are accessible.
               
               Only property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` are accessible. Accessible property names are escaped according to the following rules when accessed in the expression: - '__' escapes to '__underscores__' - '.' escapes to '__dot__' - '-' escapes to '__dash__' - '/' escapes to '__slash__' - Property names that exactly match a CEL RESERVED keyword escape to '__{keyword}__'. The keywords are:
               	  "true", "false", "null", "in", "as", "break", "const", "continue", "else", "for", "function", "if",
               	  "import", "let", "loop", "package", "namespace", "return".
               Examples:
                 - Expression accessing a property named "namespace": {"Expression": "object.__namespace__ > 0"}
                 - Expression accessing a property named "x-prop": {"Expression": "object.x__dash__prop > 0"}
                 - Expression accessing a property named "redact__d": {"Expression": "object.redact__underscores__d > 0"}
               
               Equality on arrays with list type of 'set' or 'map' ignores element order, i.e. [1, 2] == [2, 1]. Concatenation on arrays with x-kubernetes-list-type use the semantics of the list type:
                 - 'set': `X + Y` performs a union where the array positions of all elements in `X` are preserved and
                   non-intersecting elements in `Y` are appended, retaining their partial order.
                 - 'map': `X + Y` performs a merge where the array positions of all keys in `X` are preserved but the values
                   are overwritten by values in `Y` when the key sets of `X` and `Y` intersect. Elements in `Y` with
                   non-intersecting keys are appended, retaining their partial order.
               Required.
        :param str message: Message represents the message displayed when validation fails. The message is required if the Expression contains line breaks. The message must not contain line breaks. If unset, the message is "failed rule: {Rule}". e.g. "must be a URL with the host matching spec.host" If the Expression contains line breaks. Message is required. The message must not contain line breaks. If unset, the message is "failed Expression: {Expression}".
        :param str reason: Reason represents a machine-readable description of why this validation failed. If this is the first validation in the list to fail, this reason, as well as the corresponding HTTP response code, are used in the HTTP response to the client. The currently supported reasons are: "Unauthorized", "Forbidden", "Invalid", "RequestEntityTooLarge". If not set, StatusReasonInvalid is used in the response to the client.
        """
        pulumi.set(__self__, "expression", expression)
        if message is not None:
            pulumi.set(__self__, "message", message)
        if reason is not None:
            pulumi.set(__self__, "reason", reason)

    @property
    @pulumi.getter
    def expression(self) -> str:
        """
        Expression represents the expression which will be evaluated by CEL. ref: https://github.com/google/cel-spec CEL expressions have access to the contents of the Admission request/response, organized into CEL variables as well as some other useful variables:

        'object' - The object from the incoming request. The value is null for DELETE requests. 'oldObject' - The existing object. The value is null for CREATE requests. 'request' - Attributes of the admission request([ref](/pkg/apis/admission/types.go#AdmissionRequest)). 'params' - Parameter resource referred to by the policy binding being evaluated. Only populated if the policy has a ParamKind.

        The `apiVersion`, `kind`, `metadata.name` and `metadata.generateName` are always accessible from the root of the object. No other metadata properties are accessible.

        Only property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` are accessible. Accessible property names are escaped according to the following rules when accessed in the expression: - '__' escapes to '__underscores__' - '.' escapes to '__dot__' - '-' escapes to '__dash__' - '/' escapes to '__slash__' - Property names that exactly match a CEL RESERVED keyword escape to '__{keyword}__'. The keywords are:
        	  "true", "false", "null", "in", "as", "break", "const", "continue", "else", "for", "function", "if",
        	  "import", "let", "loop", "package", "namespace", "return".
        Examples:
          - Expression accessing a property named "namespace": {"Expression": "object.__namespace__ > 0"}
          - Expression accessing a property named "x-prop": {"Expression": "object.x__dash__prop > 0"}
          - Expression accessing a property named "redact__d": {"Expression": "object.redact__underscores__d > 0"}

        Equality on arrays with list type of 'set' or 'map' ignores element order, i.e. [1, 2] == [2, 1]. Concatenation on arrays with x-kubernetes-list-type use the semantics of the list type:
          - 'set': `X + Y` performs a union where the array positions of all elements in `X` are preserved and
            non-intersecting elements in `Y` are appended, retaining their partial order.
          - 'map': `X + Y` performs a merge where the array positions of all keys in `X` are preserved but the values
            are overwritten by values in `Y` when the key sets of `X` and `Y` intersect. Elements in `Y` with
            non-intersecting keys are appended, retaining their partial order.
        Required.
        """
        return pulumi.get(self, "expression")

    @property
    @pulumi.getter
    def message(self) -> Optional[str]:
        """
        Message represents the message displayed when validation fails. The message is required if the Expression contains line breaks. The message must not contain line breaks. If unset, the message is "failed rule: {Rule}". e.g. "must be a URL with the host matching spec.host" If the Expression contains line breaks. Message is required. The message must not contain line breaks. If unset, the message is "failed Expression: {Expression}".
        """
        return pulumi.get(self, "message")

    @property
    @pulumi.getter
    def reason(self) -> Optional[str]:
        """
        Reason represents a machine-readable description of why this validation failed. If this is the first validation in the list to fail, this reason, as well as the corresponding HTTP response code, are used in the HTTP response to the client. The currently supported reasons are: "Unauthorized", "Forbidden", "Invalid", "RequestEntityTooLarge". If not set, StatusReasonInvalid is used in the response to the client.
        """
        return pulumi.get(self, "reason")


@pulumi.output_type
class ValidationPatch(dict):
    """
    Validation specifies the CEL expression which is used to apply the validation.
    """
    def __init__(__self__, *,
                 expression: Optional[str] = None,
                 message: Optional[str] = None,
                 reason: Optional[str] = None):
        """
        Validation specifies the CEL expression which is used to apply the validation.
        :param str expression: Expression represents the expression which will be evaluated by CEL. ref: https://github.com/google/cel-spec CEL expressions have access to the contents of the Admission request/response, organized into CEL variables as well as some other useful variables:
               
               'object' - The object from the incoming request. The value is null for DELETE requests. 'oldObject' - The existing object. The value is null for CREATE requests. 'request' - Attributes of the admission request([ref](/pkg/apis/admission/types.go#AdmissionRequest)). 'params' - Parameter resource referred to by the policy binding being evaluated. Only populated if the policy has a ParamKind.
               
               The `apiVersion`, `kind`, `metadata.name` and `metadata.generateName` are always accessible from the root of the object. No other metadata properties are accessible.
               
               Only property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` are accessible. Accessible property names are escaped according to the following rules when accessed in the expression: - '__' escapes to '__underscores__' - '.' escapes to '__dot__' - '-' escapes to '__dash__' - '/' escapes to '__slash__' - Property names that exactly match a CEL RESERVED keyword escape to '__{keyword}__'. The keywords are:
               	  "true", "false", "null", "in", "as", "break", "const", "continue", "else", "for", "function", "if",
               	  "import", "let", "loop", "package", "namespace", "return".
               Examples:
                 - Expression accessing a property named "namespace": {"Expression": "object.__namespace__ > 0"}
                 - Expression accessing a property named "x-prop": {"Expression": "object.x__dash__prop > 0"}
                 - Expression accessing a property named "redact__d": {"Expression": "object.redact__underscores__d > 0"}
               
               Equality on arrays with list type of 'set' or 'map' ignores element order, i.e. [1, 2] == [2, 1]. Concatenation on arrays with x-kubernetes-list-type use the semantics of the list type:
                 - 'set': `X + Y` performs a union where the array positions of all elements in `X` are preserved and
                   non-intersecting elements in `Y` are appended, retaining their partial order.
                 - 'map': `X + Y` performs a merge where the array positions of all keys in `X` are preserved but the values
                   are overwritten by values in `Y` when the key sets of `X` and `Y` intersect. Elements in `Y` with
                   non-intersecting keys are appended, retaining their partial order.
               Required.
        :param str message: Message represents the message displayed when validation fails. The message is required if the Expression contains line breaks. The message must not contain line breaks. If unset, the message is "failed rule: {Rule}". e.g. "must be a URL with the host matching spec.host" If the Expression contains line breaks. Message is required. The message must not contain line breaks. If unset, the message is "failed Expression: {Expression}".
        :param str reason: Reason represents a machine-readable description of why this validation failed. If this is the first validation in the list to fail, this reason, as well as the corresponding HTTP response code, are used in the HTTP response to the client. The currently supported reasons are: "Unauthorized", "Forbidden", "Invalid", "RequestEntityTooLarge". If not set, StatusReasonInvalid is used in the response to the client.
        """
        if expression is not None:
            pulumi.set(__self__, "expression", expression)
        if message is not None:
            pulumi.set(__self__, "message", message)
        if reason is not None:
            pulumi.set(__self__, "reason", reason)

    @property
    @pulumi.getter
    def expression(self) -> Optional[str]:
        """
        Expression represents the expression which will be evaluated by CEL. ref: https://github.com/google/cel-spec CEL expressions have access to the contents of the Admission request/response, organized into CEL variables as well as some other useful variables:

        'object' - The object from the incoming request. The value is null for DELETE requests. 'oldObject' - The existing object. The value is null for CREATE requests. 'request' - Attributes of the admission request([ref](/pkg/apis/admission/types.go#AdmissionRequest)). 'params' - Parameter resource referred to by the policy binding being evaluated. Only populated if the policy has a ParamKind.

        The `apiVersion`, `kind`, `metadata.name` and `metadata.generateName` are always accessible from the root of the object. No other metadata properties are accessible.

        Only property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` are accessible. Accessible property names are escaped according to the following rules when accessed in the expression: - '__' escapes to '__underscores__' - '.' escapes to '__dot__' - '-' escapes to '__dash__' - '/' escapes to '__slash__' - Property names that exactly match a CEL RESERVED keyword escape to '__{keyword}__'. The keywords are:
        	  "true", "false", "null", "in", "as", "break", "const", "continue", "else", "for", "function", "if",
        	  "import", "let", "loop", "package", "namespace", "return".
        Examples:
          - Expression accessing a property named "namespace": {"Expression": "object.__namespace__ > 0"}
          - Expression accessing a property named "x-prop": {"Expression": "object.x__dash__prop > 0"}
          - Expression accessing a property named "redact__d": {"Expression": "object.redact__underscores__d > 0"}

        Equality on arrays with list type of 'set' or 'map' ignores element order, i.e. [1, 2] == [2, 1]. Concatenation on arrays with x-kubernetes-list-type use the semantics of the list type:
          - 'set': `X + Y` performs a union where the array positions of all elements in `X` are preserved and
            non-intersecting elements in `Y` are appended, retaining their partial order.
          - 'map': `X + Y` performs a merge where the array positions of all keys in `X` are preserved but the values
            are overwritten by values in `Y` when the key sets of `X` and `Y` intersect. Elements in `Y` with
            non-intersecting keys are appended, retaining their partial order.
        Required.
        """
        return pulumi.get(self, "expression")

    @property
    @pulumi.getter
    def message(self) -> Optional[str]:
        """
        Message represents the message displayed when validation fails. The message is required if the Expression contains line breaks. The message must not contain line breaks. If unset, the message is "failed rule: {Rule}". e.g. "must be a URL with the host matching spec.host" If the Expression contains line breaks. Message is required. The message must not contain line breaks. If unset, the message is "failed Expression: {Expression}".
        """
        return pulumi.get(self, "message")

    @property
    @pulumi.getter
    def reason(self) -> Optional[str]:
        """
        Reason represents a machine-readable description of why this validation failed. If this is the first validation in the list to fail, this reason, as well as the corresponding HTTP response code, are used in the HTTP response to the client. The currently supported reasons are: "Unauthorized", "Forbidden", "Invalid", "RequestEntityTooLarge". If not set, StatusReasonInvalid is used in the response to the client.
        """
        return pulumi.get(self, "reason")


