ForgejoNamespacePolicy

• API version: forgejo.weebo.io/v1alpha1
• Scope: Cluster
• Short names: fjnp
• Guide: The allow-list

Namespace allow-list for the namespaced kinds, enforced by the admission webhook (CREATE/UPDATE) and re-checked by every reconciler. It governs the CRs bound to a ForgejoInstance (shared by every namespace); a CR bound to a ForgejoLocalInstance is bounded by its namespace's own token instead.

While no ForgejoNamespacePolicy exists, everything is allowed. As soon as one exists, a namespaced CR is only accepted if some Allow rule matches its namespace and kind and covers the organizations, users and templates it references — and no Deny rule matches. Rules of every policy are pooled; deny always wins.

ExampleCopy Anchor Link

apiVersion: forgejo.weebo.io/v1alpha1
kind: ForgejoNamespacePolicy
metadata:
  name: my-namespacepolicy
spec:
  rules:
    - namespaces:
        - team-*
      allowedKinds:
        - ForgejoRepository

Spec fieldsCopy Anchor Link

Build a manifestCopy Anchor Link

Answer the questions and fill in the fields: the YAML preview updates as you type, ready to copy or download and kubectl apply.

Loading form...