pulumi-kubernetes 4.22.2__py3-none-any.whl → 4.23.0__py3-none-any.whl

pulumi_kubernetes/__init__.py

@@ -364,7 +364,10 @@ _utilities.register(
   "classes": {
    "kubernetes:certificates.k8s.io/v1beta1:CertificateSigningRequest": "CertificateSigningRequest",
    "kubernetes:certificates.k8s.io/v1beta1:CertificateSigningRequestList": "CertificateSigningRequestList",
-   "kubernetes:certificates.k8s.io/v1beta1:CertificateSigningRequestPatch": "CertificateSigningRequestPatch"
+   "kubernetes:certificates.k8s.io/v1beta1:CertificateSigningRequestPatch": "CertificateSigningRequestPatch",
+   "kubernetes:certificates.k8s.io/v1beta1:ClusterTrustBundle": "ClusterTrustBundle",
+   "kubernetes:certificates.k8s.io/v1beta1:ClusterTrustBundleList": "ClusterTrustBundleList",
+   "kubernetes:certificates.k8s.io/v1beta1:ClusterTrustBundlePatch": "ClusterTrustBundlePatch"
   }
  },
  {
@@ -403,6 +406,9 @@ _utilities.register(
   "fqn": "pulumi_kubernetes.coordination.v1beta1",
   "classes": {
    "kubernetes:coordination.k8s.io/v1beta1:Lease": "Lease",
+   "kubernetes:coordination.k8s.io/v1beta1:LeaseCandidate": "LeaseCandidate",
+   "kubernetes:coordination.k8s.io/v1beta1:LeaseCandidateList": "LeaseCandidateList",
+   "kubernetes:coordination.k8s.io/v1beta1:LeaseCandidatePatch": "LeaseCandidatePatch",
    "kubernetes:coordination.k8s.io/v1beta1:LeaseList": "LeaseList",
    "kubernetes:coordination.k8s.io/v1beta1:LeasePatch": "LeasePatch"
   }
@@ -629,6 +635,9 @@ _utilities.register(
   "mod": "networking.k8s.io/v1",
   "fqn": "pulumi_kubernetes.networking.v1",
   "classes": {
+   "kubernetes:networking.k8s.io/v1:IPAddress": "IPAddress",
+   "kubernetes:networking.k8s.io/v1:IPAddressList": "IPAddressList",
+   "kubernetes:networking.k8s.io/v1:IPAddressPatch": "IPAddressPatch",
    "kubernetes:networking.k8s.io/v1:Ingress": "Ingress",
    "kubernetes:networking.k8s.io/v1:IngressClass": "IngressClass",
    "kubernetes:networking.k8s.io/v1:IngressClassList": "IngressClassList",
@@ -637,7 +646,10 @@ _utilities.register(
    "kubernetes:networking.k8s.io/v1:IngressPatch": "IngressPatch",
    "kubernetes:networking.k8s.io/v1:NetworkPolicy": "NetworkPolicy",
    "kubernetes:networking.k8s.io/v1:NetworkPolicyList": "NetworkPolicyList",
-   "kubernetes:networking.k8s.io/v1:NetworkPolicyPatch": "NetworkPolicyPatch"
+   "kubernetes:networking.k8s.io/v1:NetworkPolicyPatch": "NetworkPolicyPatch",
+   "kubernetes:networking.k8s.io/v1:ServiceCIDR": "ServiceCIDR",
+   "kubernetes:networking.k8s.io/v1:ServiceCIDRList": "ServiceCIDRList",
+   "kubernetes:networking.k8s.io/v1:ServiceCIDRPatch": "ServiceCIDRPatch"
   }
  },
  {
@@ -840,6 +852,9 @@ _utilities.register(
    "kubernetes:resource.k8s.io/v1alpha3:DeviceClass": "DeviceClass",
    "kubernetes:resource.k8s.io/v1alpha3:DeviceClassList": "DeviceClassList",
    "kubernetes:resource.k8s.io/v1alpha3:DeviceClassPatch": "DeviceClassPatch",
+   "kubernetes:resource.k8s.io/v1alpha3:DeviceTaintRule": "DeviceTaintRule",
+   "kubernetes:resource.k8s.io/v1alpha3:DeviceTaintRuleList": "DeviceTaintRuleList",
+   "kubernetes:resource.k8s.io/v1alpha3:DeviceTaintRulePatch": "DeviceTaintRulePatch",
    "kubernetes:resource.k8s.io/v1alpha3:PodSchedulingContext": "PodSchedulingContext",
    "kubernetes:resource.k8s.io/v1alpha3:PodSchedulingContextList": "PodSchedulingContextList",
    "kubernetes:resource.k8s.io/v1alpha3:PodSchedulingContextPatch": "PodSchedulingContextPatch",
@@ -873,6 +888,25 @@ _utilities.register(
    "kubernetes:resource.k8s.io/v1beta1:ResourceSlicePatch": "ResourceSlicePatch"
   }
  },
+ {
+  "pkg": "kubernetes",
+  "mod": "resource.k8s.io/v1beta2",
+  "fqn": "pulumi_kubernetes.resource.v1beta2",
+  "classes": {
+   "kubernetes:resource.k8s.io/v1beta2:DeviceClass": "DeviceClass",
+   "kubernetes:resource.k8s.io/v1beta2:DeviceClassList": "DeviceClassList",
+   "kubernetes:resource.k8s.io/v1beta2:DeviceClassPatch": "DeviceClassPatch",
+   "kubernetes:resource.k8s.io/v1beta2:ResourceClaim": "ResourceClaim",
+   "kubernetes:resource.k8s.io/v1beta2:ResourceClaimList": "ResourceClaimList",
+   "kubernetes:resource.k8s.io/v1beta2:ResourceClaimPatch": "ResourceClaimPatch",
+   "kubernetes:resource.k8s.io/v1beta2:ResourceClaimTemplate": "ResourceClaimTemplate",
+   "kubernetes:resource.k8s.io/v1beta2:ResourceClaimTemplateList": "ResourceClaimTemplateList",
+   "kubernetes:resource.k8s.io/v1beta2:ResourceClaimTemplatePatch": "ResourceClaimTemplatePatch",
+   "kubernetes:resource.k8s.io/v1beta2:ResourceSlice": "ResourceSlice",
+   "kubernetes:resource.k8s.io/v1beta2:ResourceSliceList": "ResourceSliceList",
+   "kubernetes:resource.k8s.io/v1beta2:ResourceSlicePatch": "ResourceSlicePatch"
+  }
+ },
  {
   "pkg": "kubernetes",
   "mod": "scheduling.k8s.io/v1",

pulumi_kubernetes/admissionregistration/v1/MutatingWebhookConfiguration.py

@@ -92,6 +92,7 @@ class MutatingWebhookConfigurationInitArgs:
         pulumi.set(self, "webhooks", value)
 
 
+@pulumi.type_token("kubernetes:admissionregistration.k8s.io/v1:MutatingWebhookConfiguration")
 class MutatingWebhookConfiguration(pulumi.CustomResource):
     @overload
     def __init__(__self__,

pulumi_kubernetes/admissionregistration/v1/MutatingWebhookConfigurationList.py

@@ -91,6 +91,7 @@ class MutatingWebhookConfigurationListArgs:
         pulumi.set(self, "metadata", value)
 
 
+@pulumi.type_token("kubernetes:admissionregistration.k8s.io/v1:MutatingWebhookConfigurationList")
 class MutatingWebhookConfigurationList(pulumi.CustomResource):
     @overload
     def __init__(__self__,

pulumi_kubernetes/admissionregistration/v1/MutatingWebhookConfigurationPatch.py

@@ -92,6 +92,7 @@ class MutatingWebhookConfigurationPatchArgs:
         pulumi.set(self, "webhooks", value)
 
 
+@pulumi.type_token("kubernetes:admissionregistration.k8s.io/v1:MutatingWebhookConfigurationPatch")
 class MutatingWebhookConfigurationPatch(pulumi.CustomResource):
     @overload
     def __init__(__self__,

pulumi_kubernetes/admissionregistration/v1/ValidatingAdmissionPolicy.py

@@ -92,6 +92,7 @@ class ValidatingAdmissionPolicyInitArgs:
         pulumi.set(self, "spec", value)
 
 
+@pulumi.type_token("kubernetes:admissionregistration.k8s.io/v1:ValidatingAdmissionPolicy")
 class ValidatingAdmissionPolicy(pulumi.CustomResource):
     @overload
     def __init__(__self__,

pulumi_kubernetes/admissionregistration/v1/ValidatingAdmissionPolicyBinding.py

@@ -92,6 +92,7 @@ class ValidatingAdmissionPolicyBindingInitArgs:
         pulumi.set(self, "spec", value)
 
 
+@pulumi.type_token("kubernetes:admissionregistration.k8s.io/v1:ValidatingAdmissionPolicyBinding")
 class ValidatingAdmissionPolicyBinding(pulumi.CustomResource):
     @overload
     def __init__(__self__,

pulumi_kubernetes/admissionregistration/v1/ValidatingAdmissionPolicyBindingList.py

@@ -91,6 +91,7 @@ class ValidatingAdmissionPolicyBindingListArgs:
         pulumi.set(self, "metadata", value)
 
 
+@pulumi.type_token("kubernetes:admissionregistration.k8s.io/v1:ValidatingAdmissionPolicyBindingList")
 class ValidatingAdmissionPolicyBindingList(pulumi.CustomResource):
     @overload
     def __init__(__self__,

pulumi_kubernetes/admissionregistration/v1/ValidatingAdmissionPolicyBindingPatch.py

@@ -92,6 +92,7 @@ class ValidatingAdmissionPolicyBindingPatchArgs:
         pulumi.set(self, "spec", value)
 
 
+@pulumi.type_token("kubernetes:admissionregistration.k8s.io/v1:ValidatingAdmissionPolicyBindingPatch")
 class ValidatingAdmissionPolicyBindingPatch(pulumi.CustomResource):
     @overload
     def __init__(__self__,

pulumi_kubernetes/admissionregistration/v1/ValidatingAdmissionPolicyList.py

@@ -91,6 +91,7 @@ class ValidatingAdmissionPolicyListArgs:
         pulumi.set(self, "metadata", value)
 
 
+@pulumi.type_token("kubernetes:admissionregistration.k8s.io/v1:ValidatingAdmissionPolicyList")
 class ValidatingAdmissionPolicyList(pulumi.CustomResource):
     @overload
     def __init__(__self__,

pulumi_kubernetes/admissionregistration/v1/ValidatingAdmissionPolicyPatch.py

@@ -92,6 +92,7 @@ class ValidatingAdmissionPolicyPatchArgs:
         pulumi.set(self, "spec", value)
 
 
+@pulumi.type_token("kubernetes:admissionregistration.k8s.io/v1:ValidatingAdmissionPolicyPatch")
 class ValidatingAdmissionPolicyPatch(pulumi.CustomResource):
     @overload
     def __init__(__self__,

pulumi_kubernetes/admissionregistration/v1/ValidatingWebhookConfiguration.py

@@ -92,6 +92,7 @@ class ValidatingWebhookConfigurationInitArgs:
         pulumi.set(self, "webhooks", value)
 
 
+@pulumi.type_token("kubernetes:admissionregistration.k8s.io/v1:ValidatingWebhookConfiguration")
 class ValidatingWebhookConfiguration(pulumi.CustomResource):
     @overload
     def __init__(__self__,

pulumi_kubernetes/admissionregistration/v1/ValidatingWebhookConfigurationList.py

@@ -91,6 +91,7 @@ class ValidatingWebhookConfigurationListArgs:
         pulumi.set(self, "metadata", value)
 
 
+@pulumi.type_token("kubernetes:admissionregistration.k8s.io/v1:ValidatingWebhookConfigurationList")
 class ValidatingWebhookConfigurationList(pulumi.CustomResource):
     @overload
     def __init__(__self__,

pulumi_kubernetes/admissionregistration/v1/ValidatingWebhookConfigurationPatch.py

@@ -92,6 +92,7 @@ class ValidatingWebhookConfigurationPatchArgs:
         pulumi.set(self, "webhooks", value)
 
 
+@pulumi.type_token("kubernetes:admissionregistration.k8s.io/v1:ValidatingWebhookConfigurationPatch")
 class ValidatingWebhookConfigurationPatch(pulumi.CustomResource):
     @overload
     def __init__(__self__,

pulumi_kubernetes/admissionregistration/v1alpha1/MutatingAdmissionPolicy.py

@@ -92,6 +92,7 @@ class MutatingAdmissionPolicyInitArgs:
         pulumi.set(self, "spec", value)
 
 
+@pulumi.type_token("kubernetes:admissionregistration.k8s.io/v1alpha1:MutatingAdmissionPolicy")
 class MutatingAdmissionPolicy(pulumi.CustomResource):
     @overload
     def __init__(__self__,

pulumi_kubernetes/admissionregistration/v1alpha1/MutatingAdmissionPolicyBinding.py

@@ -92,6 +92,7 @@ class MutatingAdmissionPolicyBindingInitArgs:
         pulumi.set(self, "spec", value)
 
 
+@pulumi.type_token("kubernetes:admissionregistration.k8s.io/v1alpha1:MutatingAdmissionPolicyBinding")
 class MutatingAdmissionPolicyBinding(pulumi.CustomResource):
     @overload
     def __init__(__self__,

pulumi_kubernetes/admissionregistration/v1alpha1/MutatingAdmissionPolicyBindingList.py

@@ -91,6 +91,7 @@ class MutatingAdmissionPolicyBindingListArgs:
         pulumi.set(self, "metadata", value)
 
 
+@pulumi.type_token("kubernetes:admissionregistration.k8s.io/v1alpha1:MutatingAdmissionPolicyBindingList")
 class MutatingAdmissionPolicyBindingList(pulumi.CustomResource):
     @overload
     def __init__(__self__,

pulumi_kubernetes/admissionregistration/v1alpha1/MutatingAdmissionPolicyBindingPatch.py

@@ -92,6 +92,7 @@ class MutatingAdmissionPolicyBindingPatchArgs:
         pulumi.set(self, "spec", value)
 
 
+@pulumi.type_token("kubernetes:admissionregistration.k8s.io/v1alpha1:MutatingAdmissionPolicyBindingPatch")
 class MutatingAdmissionPolicyBindingPatch(pulumi.CustomResource):
     @overload
     def __init__(__self__,

pulumi_kubernetes/admissionregistration/v1alpha1/MutatingAdmissionPolicyList.py

@@ -91,6 +91,7 @@ class MutatingAdmissionPolicyListArgs:
         pulumi.set(self, "metadata", value)
 
 
+@pulumi.type_token("kubernetes:admissionregistration.k8s.io/v1alpha1:MutatingAdmissionPolicyList")
 class MutatingAdmissionPolicyList(pulumi.CustomResource):
     @overload
     def __init__(__self__,

pulumi_kubernetes/admissionregistration/v1alpha1/MutatingAdmissionPolicyPatch.py

@@ -92,6 +92,7 @@ class MutatingAdmissionPolicyPatchArgs:
         pulumi.set(self, "spec", value)
 
 
+@pulumi.type_token("kubernetes:admissionregistration.k8s.io/v1alpha1:MutatingAdmissionPolicyPatch")
 class MutatingAdmissionPolicyPatch(pulumi.CustomResource):
     @overload
     def __init__(__self__,

pulumi_kubernetes/admissionregistration/v1alpha1/ValidatingAdmissionPolicy.py

@@ -92,6 +92,7 @@ class ValidatingAdmissionPolicyInitArgs:
         pulumi.set(self, "spec", value)
 
 
+@pulumi.type_token("kubernetes:admissionregistration.k8s.io/v1alpha1:ValidatingAdmissionPolicy")
 class ValidatingAdmissionPolicy(pulumi.CustomResource):
     @overload
     def __init__(__self__,

pulumi_kubernetes/admissionregistration/v1alpha1/ValidatingAdmissionPolicyBinding.py

@@ -92,6 +92,7 @@ class ValidatingAdmissionPolicyBindingInitArgs:
         pulumi.set(self, "spec", value)
 
 
+@pulumi.type_token("kubernetes:admissionregistration.k8s.io/v1alpha1:ValidatingAdmissionPolicyBinding")
 class ValidatingAdmissionPolicyBinding(pulumi.CustomResource):
     @overload
     def __init__(__self__,

pulumi_kubernetes/admissionregistration/v1alpha1/ValidatingAdmissionPolicyBindingList.py

@@ -91,6 +91,7 @@ class ValidatingAdmissionPolicyBindingListArgs:
         pulumi.set(self, "metadata", value)
 
 
+@pulumi.type_token("kubernetes:admissionregistration.k8s.io/v1alpha1:ValidatingAdmissionPolicyBindingList")
 class ValidatingAdmissionPolicyBindingList(pulumi.CustomResource):
     @overload
     def __init__(__self__,

pulumi_kubernetes/admissionregistration/v1alpha1/ValidatingAdmissionPolicyBindingPatch.py

@@ -92,6 +92,7 @@ class ValidatingAdmissionPolicyBindingPatchArgs:
         pulumi.set(self, "spec", value)
 
 
+@pulumi.type_token("kubernetes:admissionregistration.k8s.io/v1alpha1:ValidatingAdmissionPolicyBindingPatch")
 class ValidatingAdmissionPolicyBindingPatch(pulumi.CustomResource):
     @overload
     def __init__(__self__,

pulumi_kubernetes/admissionregistration/v1alpha1/ValidatingAdmissionPolicyList.py

@@ -91,6 +91,7 @@ class ValidatingAdmissionPolicyListArgs:
         pulumi.set(self, "metadata", value)
 
 
+@pulumi.type_token("kubernetes:admissionregistration.k8s.io/v1alpha1:ValidatingAdmissionPolicyList")
 class ValidatingAdmissionPolicyList(pulumi.CustomResource):
     @overload
     def __init__(__self__,

pulumi_kubernetes/admissionregistration/v1alpha1/ValidatingAdmissionPolicyPatch.py

@@ -92,6 +92,7 @@ class ValidatingAdmissionPolicyPatchArgs:
         pulumi.set(self, "spec", value)
 
 
+@pulumi.type_token("kubernetes:admissionregistration.k8s.io/v1alpha1:ValidatingAdmissionPolicyPatch")
 class ValidatingAdmissionPolicyPatch(pulumi.CustomResource):
     @overload
     def __init__(__self__,

pulumi_kubernetes/admissionregistration/v1alpha1/_inputs.py

@@ -1112,15 +1112,15 @@ if not MYPY:
         """
         exclude_resource_rules: NotRequired[pulumi.Input[Sequence[pulumi.Input['NamedRuleWithOperationsPatchArgsDict']]]]
         """
-        ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. The exclude rules take precedence over include rules (if a resource matches both, it is excluded)
+        ExcludeResourceRules describes what operations on what resources/subresources the policy should not care about. The exclude rules take precedence over include rules (if a resource matches both, it is excluded)
         """
         match_policy: NotRequired[pulumi.Input[builtins.str]]
         """
         matchPolicy defines how the "MatchResources" list is used to match incoming requests. Allowed values are "Exact" or "Equivalent".
 
-        - Exact: match a request only if it exactly matches a specified rule. For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy.
+        - Exact: match a request only if it exactly matches a specified rule. For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, the admission policy does not consider requests to apps/v1beta1 or extensions/v1beta1 API groups.
 
-        - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy.
+        - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, the admission policy **does** consider requests made to apps/v1beta1 or extensions/v1beta1 API groups. The API server translates the request to a matched resource API if necessary.
 
         Defaults to "Equivalent"
         """
@@ -1160,11 +1160,11 @@ if not MYPY:
         """
         object_selector: NotRequired[pulumi.Input['_meta.v1.LabelSelectorPatchArgsDict']]
         """
-        ObjectSelector decides whether to run the validation based on if the object has matching labels. objectSelector is evaluated against both the oldObject and newObject that would be sent to the cel validation, and is considered to match if either object matches the selector. A null object (oldObject in the case of create, or newObject in the case of delete) or an object that cannot have labels (like a DeploymentRollback or a PodProxyOptions object) is not considered to match. Use the object selector only if the webhook is opt-in, because end users may skip the admission webhook by setting the labels. Default to the empty LabelSelector, which matches everything.
+        ObjectSelector decides whether to run the policy based on if the object has matching labels. objectSelector is evaluated against both the oldObject and newObject that would be sent to the policy's expression (CEL), and is considered to match if either object matches the selector. A null object (oldObject in the case of create, or newObject in the case of delete) or an object that cannot have labels (like a DeploymentRollback or a PodProxyOptions object) is not considered to match. Use the object selector only if the webhook is opt-in, because end users may skip the admission webhook by setting the labels. Default to the empty LabelSelector, which matches everything.
         """
         resource_rules: NotRequired[pulumi.Input[Sequence[pulumi.Input['NamedRuleWithOperationsPatchArgsDict']]]]
         """
-        ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. The policy cares about an operation if it matches _any_ Rule.
+        ResourceRules describes what operations on what resources/subresources the admission policy matches. The policy cares about an operation if it matches _any_ Rule.
         """
 elif False:
     MatchResourcesPatchArgsDict: TypeAlias = Mapping[str, Any]
@@ -1179,12 +1179,12 @@ class MatchResourcesPatchArgs:
                  resource_rules: Optional[pulumi.Input[Sequence[pulumi.Input['NamedRuleWithOperationsPatchArgs']]]] = None):
         """
         MatchResources decides whether to run the admission control policy on an object based on whether it meets the match criteria. The exclude rules take precedence over include rules (if a resource matches both, it is excluded)
-        :param pulumi.Input[Sequence[pulumi.Input['NamedRuleWithOperationsPatchArgs']]] exclude_resource_rules: ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. The exclude rules take precedence over include rules (if a resource matches both, it is excluded)
+        :param pulumi.Input[Sequence[pulumi.Input['NamedRuleWithOperationsPatchArgs']]] exclude_resource_rules: ExcludeResourceRules describes what operations on what resources/subresources the policy should not care about. The exclude rules take precedence over include rules (if a resource matches both, it is excluded)
         :param pulumi.Input[builtins.str] match_policy: matchPolicy defines how the "MatchResources" list is used to match incoming requests. Allowed values are "Exact" or "Equivalent".
                
-               - Exact: match a request only if it exactly matches a specified rule. For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy.
+               - Exact: match a request only if it exactly matches a specified rule. For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, the admission policy does not consider requests to apps/v1beta1 or extensions/v1beta1 API groups.
                
-               - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy.
+               - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, the admission policy **does** consider requests made to apps/v1beta1 or extensions/v1beta1 API groups. The API server translates the request to a matched resource API if necessary.
                
                Defaults to "Equivalent"
         :param pulumi.Input['_meta.v1.LabelSelectorPatchArgs'] namespace_selector: NamespaceSelector decides whether to run the admission control policy on an object based on whether the namespace for that object matches the selector. If the object itself is a namespace, the matching is performed on object.metadata.labels. If the object is another cluster scoped resource, it never skips the policy.
@@ -1218,8 +1218,8 @@ class MatchResourcesPatchArgs:
                See https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ for more examples of label selectors.
                
                Default to the empty LabelSelector, which matches everything.
-        :param pulumi.Input['_meta.v1.LabelSelectorPatchArgs'] object_selector: ObjectSelector decides whether to run the validation based on if the object has matching labels. objectSelector is evaluated against both the oldObject and newObject that would be sent to the cel validation, and is considered to match if either object matches the selector. A null object (oldObject in the case of create, or newObject in the case of delete) or an object that cannot have labels (like a DeploymentRollback or a PodProxyOptions object) is not considered to match. Use the object selector only if the webhook is opt-in, because end users may skip the admission webhook by setting the labels. Default to the empty LabelSelector, which matches everything.
-        :param pulumi.Input[Sequence[pulumi.Input['NamedRuleWithOperationsPatchArgs']]] resource_rules: ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. The policy cares about an operation if it matches _any_ Rule.
+        :param pulumi.Input['_meta.v1.LabelSelectorPatchArgs'] object_selector: ObjectSelector decides whether to run the policy based on if the object has matching labels. objectSelector is evaluated against both the oldObject and newObject that would be sent to the policy's expression (CEL), and is considered to match if either object matches the selector. A null object (oldObject in the case of create, or newObject in the case of delete) or an object that cannot have labels (like a DeploymentRollback or a PodProxyOptions object) is not considered to match. Use the object selector only if the webhook is opt-in, because end users may skip the admission webhook by setting the labels. Default to the empty LabelSelector, which matches everything.
+        :param pulumi.Input[Sequence[pulumi.Input['NamedRuleWithOperationsPatchArgs']]] resource_rules: ResourceRules describes what operations on what resources/subresources the admission policy matches. The policy cares about an operation if it matches _any_ Rule.
         """
         if exclude_resource_rules is not None:
             pulumi.set(__self__, "exclude_resource_rules", exclude_resource_rules)
@@ -1236,7 +1236,7 @@ class MatchResourcesPatchArgs:
     @pulumi.getter(name="excludeResourceRules")
     def exclude_resource_rules(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['NamedRuleWithOperationsPatchArgs']]]]:
         """
-        ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. The exclude rules take precedence over include rules (if a resource matches both, it is excluded)
+        ExcludeResourceRules describes what operations on what resources/subresources the policy should not care about. The exclude rules take precedence over include rules (if a resource matches both, it is excluded)
         """
         return pulumi.get(self, "exclude_resource_rules")
 
@@ -1250,9 +1250,9 @@ class MatchResourcesPatchArgs:
         """
         matchPolicy defines how the "MatchResources" list is used to match incoming requests. Allowed values are "Exact" or "Equivalent".
 
-        - Exact: match a request only if it exactly matches a specified rule. For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy.
+        - Exact: match a request only if it exactly matches a specified rule. For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, the admission policy does not consider requests to apps/v1beta1 or extensions/v1beta1 API groups.
 
-        - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy.
+        - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, the admission policy **does** consider requests made to apps/v1beta1 or extensions/v1beta1 API groups. The API server translates the request to a matched resource API if necessary.
 
         Defaults to "Equivalent"
         """
@@ -1308,7 +1308,7 @@ class MatchResourcesPatchArgs:
     @pulumi.getter(name="objectSelector")
     def object_selector(self) -> Optional[pulumi.Input['_meta.v1.LabelSelectorPatchArgs']]:
         """
-        ObjectSelector decides whether to run the validation based on if the object has matching labels. objectSelector is evaluated against both the oldObject and newObject that would be sent to the cel validation, and is considered to match if either object matches the selector. A null object (oldObject in the case of create, or newObject in the case of delete) or an object that cannot have labels (like a DeploymentRollback or a PodProxyOptions object) is not considered to match. Use the object selector only if the webhook is opt-in, because end users may skip the admission webhook by setting the labels. Default to the empty LabelSelector, which matches everything.
+        ObjectSelector decides whether to run the policy based on if the object has matching labels. objectSelector is evaluated against both the oldObject and newObject that would be sent to the policy's expression (CEL), and is considered to match if either object matches the selector. A null object (oldObject in the case of create, or newObject in the case of delete) or an object that cannot have labels (like a DeploymentRollback or a PodProxyOptions object) is not considered to match. Use the object selector only if the webhook is opt-in, because end users may skip the admission webhook by setting the labels. Default to the empty LabelSelector, which matches everything.
         """
         return pulumi.get(self, "object_selector")
 
@@ -1320,7 +1320,7 @@ class MatchResourcesPatchArgs:
     @pulumi.getter(name="resourceRules")
     def resource_rules(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['NamedRuleWithOperationsPatchArgs']]]]:
         """
-        ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. The policy cares about an operation if it matches _any_ Rule.
+        ResourceRules describes what operations on what resources/subresources the admission policy matches. The policy cares about an operation if it matches _any_ Rule.
         """
         return pulumi.get(self, "resource_rules")
 
@@ -1336,15 +1336,15 @@ if not MYPY:
         """
         exclude_resource_rules: NotRequired[pulumi.Input[Sequence[pulumi.Input['NamedRuleWithOperationsArgsDict']]]]
         """
-        ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. The exclude rules take precedence over include rules (if a resource matches both, it is excluded)
+        ExcludeResourceRules describes what operations on what resources/subresources the policy should not care about. The exclude rules take precedence over include rules (if a resource matches both, it is excluded)
         """
         match_policy: NotRequired[pulumi.Input[builtins.str]]
         """
         matchPolicy defines how the "MatchResources" list is used to match incoming requests. Allowed values are "Exact" or "Equivalent".
 
-        - Exact: match a request only if it exactly matches a specified rule. For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy.
+        - Exact: match a request only if it exactly matches a specified rule. For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, the admission policy does not consider requests to apps/v1beta1 or extensions/v1beta1 API groups.
 
-        - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy.
+        - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, the admission policy **does** consider requests made to apps/v1beta1 or extensions/v1beta1 API groups. The API server translates the request to a matched resource API if necessary.
 
         Defaults to "Equivalent"
         """
@@ -1384,11 +1384,11 @@ if not MYPY:
         """
         object_selector: NotRequired[pulumi.Input['_meta.v1.LabelSelectorArgsDict']]
         """
-        ObjectSelector decides whether to run the validation based on if the object has matching labels. objectSelector is evaluated against both the oldObject and newObject that would be sent to the cel validation, and is considered to match if either object matches the selector. A null object (oldObject in the case of create, or newObject in the case of delete) or an object that cannot have labels (like a DeploymentRollback or a PodProxyOptions object) is not considered to match. Use the object selector only if the webhook is opt-in, because end users may skip the admission webhook by setting the labels. Default to the empty LabelSelector, which matches everything.
+        ObjectSelector decides whether to run the policy based on if the object has matching labels. objectSelector is evaluated against both the oldObject and newObject that would be sent to the policy's expression (CEL), and is considered to match if either object matches the selector. A null object (oldObject in the case of create, or newObject in the case of delete) or an object that cannot have labels (like a DeploymentRollback or a PodProxyOptions object) is not considered to match. Use the object selector only if the webhook is opt-in, because end users may skip the admission webhook by setting the labels. Default to the empty LabelSelector, which matches everything.
         """
         resource_rules: NotRequired[pulumi.Input[Sequence[pulumi.Input['NamedRuleWithOperationsArgsDict']]]]
         """
-        ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. The policy cares about an operation if it matches _any_ Rule.
+        ResourceRules describes what operations on what resources/subresources the admission policy matches. The policy cares about an operation if it matches _any_ Rule.
         """
 elif False:
     MatchResourcesArgsDict: TypeAlias = Mapping[str, Any]
@@ -1403,12 +1403,12 @@ class MatchResourcesArgs:
                  resource_rules: Optional[pulumi.Input[Sequence[pulumi.Input['NamedRuleWithOperationsArgs']]]] = None):
         """
         MatchResources decides whether to run the admission control policy on an object based on whether it meets the match criteria. The exclude rules take precedence over include rules (if a resource matches both, it is excluded)
-        :param pulumi.Input[Sequence[pulumi.Input['NamedRuleWithOperationsArgs']]] exclude_resource_rules: ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. The exclude rules take precedence over include rules (if a resource matches both, it is excluded)
+        :param pulumi.Input[Sequence[pulumi.Input['NamedRuleWithOperationsArgs']]] exclude_resource_rules: ExcludeResourceRules describes what operations on what resources/subresources the policy should not care about. The exclude rules take precedence over include rules (if a resource matches both, it is excluded)
         :param pulumi.Input[builtins.str] match_policy: matchPolicy defines how the "MatchResources" list is used to match incoming requests. Allowed values are "Exact" or "Equivalent".
                
-               - Exact: match a request only if it exactly matches a specified rule. For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy.
+               - Exact: match a request only if it exactly matches a specified rule. For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, the admission policy does not consider requests to apps/v1beta1 or extensions/v1beta1 API groups.
                
-               - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy.
+               - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, the admission policy **does** consider requests made to apps/v1beta1 or extensions/v1beta1 API groups. The API server translates the request to a matched resource API if necessary.
                
                Defaults to "Equivalent"
         :param pulumi.Input['_meta.v1.LabelSelectorArgs'] namespace_selector: NamespaceSelector decides whether to run the admission control policy on an object based on whether the namespace for that object matches the selector. If the object itself is a namespace, the matching is performed on object.metadata.labels. If the object is another cluster scoped resource, it never skips the policy.
@@ -1442,8 +1442,8 @@ class MatchResourcesArgs:
                See https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ for more examples of label selectors.
                
                Default to the empty LabelSelector, which matches everything.
-        :param pulumi.Input['_meta.v1.LabelSelectorArgs'] object_selector: ObjectSelector decides whether to run the validation based on if the object has matching labels. objectSelector is evaluated against both the oldObject and newObject that would be sent to the cel validation, and is considered to match if either object matches the selector. A null object (oldObject in the case of create, or newObject in the case of delete) or an object that cannot have labels (like a DeploymentRollback or a PodProxyOptions object) is not considered to match. Use the object selector only if the webhook is opt-in, because end users may skip the admission webhook by setting the labels. Default to the empty LabelSelector, which matches everything.
-        :param pulumi.Input[Sequence[pulumi.Input['NamedRuleWithOperationsArgs']]] resource_rules: ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. The policy cares about an operation if it matches _any_ Rule.
+        :param pulumi.Input['_meta.v1.LabelSelectorArgs'] object_selector: ObjectSelector decides whether to run the policy based on if the object has matching labels. objectSelector is evaluated against both the oldObject and newObject that would be sent to the policy's expression (CEL), and is considered to match if either object matches the selector. A null object (oldObject in the case of create, or newObject in the case of delete) or an object that cannot have labels (like a DeploymentRollback or a PodProxyOptions object) is not considered to match. Use the object selector only if the webhook is opt-in, because end users may skip the admission webhook by setting the labels. Default to the empty LabelSelector, which matches everything.
+        :param pulumi.Input[Sequence[pulumi.Input['NamedRuleWithOperationsArgs']]] resource_rules: ResourceRules describes what operations on what resources/subresources the admission policy matches. The policy cares about an operation if it matches _any_ Rule.
         """
         if exclude_resource_rules is not None:
             pulumi.set(__self__, "exclude_resource_rules", exclude_resource_rules)
@@ -1460,7 +1460,7 @@ class MatchResourcesArgs:
     @pulumi.getter(name="excludeResourceRules")
     def exclude_resource_rules(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['NamedRuleWithOperationsArgs']]]]:
         """
-        ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. The exclude rules take precedence over include rules (if a resource matches both, it is excluded)
+        ExcludeResourceRules describes what operations on what resources/subresources the policy should not care about. The exclude rules take precedence over include rules (if a resource matches both, it is excluded)
         """
         return pulumi.get(self, "exclude_resource_rules")
 
@@ -1474,9 +1474,9 @@ class MatchResourcesArgs:
         """
         matchPolicy defines how the "MatchResources" list is used to match incoming requests. Allowed values are "Exact" or "Equivalent".
 
-        - Exact: match a request only if it exactly matches a specified rule. For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy.
+        - Exact: match a request only if it exactly matches a specified rule. For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, the admission policy does not consider requests to apps/v1beta1 or extensions/v1beta1 API groups.
 
-        - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy.
+        - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, the admission policy **does** consider requests made to apps/v1beta1 or extensions/v1beta1 API groups. The API server translates the request to a matched resource API if necessary.
 
         Defaults to "Equivalent"
         """
@@ -1532,7 +1532,7 @@ class MatchResourcesArgs:
     @pulumi.getter(name="objectSelector")
     def object_selector(self) -> Optional[pulumi.Input['_meta.v1.LabelSelectorArgs']]:
         """
-        ObjectSelector decides whether to run the validation based on if the object has matching labels. objectSelector is evaluated against both the oldObject and newObject that would be sent to the cel validation, and is considered to match if either object matches the selector. A null object (oldObject in the case of create, or newObject in the case of delete) or an object that cannot have labels (like a DeploymentRollback or a PodProxyOptions object) is not considered to match. Use the object selector only if the webhook is opt-in, because end users may skip the admission webhook by setting the labels. Default to the empty LabelSelector, which matches everything.
+        ObjectSelector decides whether to run the policy based on if the object has matching labels. objectSelector is evaluated against both the oldObject and newObject that would be sent to the policy's expression (CEL), and is considered to match if either object matches the selector. A null object (oldObject in the case of create, or newObject in the case of delete) or an object that cannot have labels (like a DeploymentRollback or a PodProxyOptions object) is not considered to match. Use the object selector only if the webhook is opt-in, because end users may skip the admission webhook by setting the labels. Default to the empty LabelSelector, which matches everything.
         """
         return pulumi.get(self, "object_selector")
 
@@ -1544,7 +1544,7 @@ class MatchResourcesArgs:
     @pulumi.getter(name="resourceRules")
     def resource_rules(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['NamedRuleWithOperationsArgs']]]]:
         """
-        ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. The policy cares about an operation if it matches _any_ Rule.
+        ResourceRules describes what operations on what resources/subresources the admission policy matches. The policy cares about an operation if it matches _any_ Rule.
         """
         return pulumi.get(self, "resource_rules")