From ec8c3695b46637353575e0c485c007a9f809772d Mon Sep 17 00:00:00 2001 From: Peter Engelbert Date: Thu, 26 Feb 2026 12:52:05 -0500 Subject: [PATCH 1/8] Rename internal AllowlistEntry field to `Command` Signed-off-by: Peter Engelbert Kubernetes-commit: c24c1e8c2e6e35835489c6b250e5dc61684409cd --- pkg/config/types.go | 6 +++--- pkg/config/v1beta1/types.go | 7 +++++++ pkg/kuberc/kuberc_test.go | 4 ++-- 3 files changed, 12 insertions(+), 5 deletions(-) diff --git a/pkg/config/types.go b/pkg/config/types.go index b310ceae4..3fecc679a 100644 --- a/pkg/config/types.go +++ b/pkg/config/types.go @@ -115,12 +115,12 @@ const ( // the logical AND of all checks corresponding to the specified fields within // the entry. type AllowlistEntry struct { - // Name matching is performed by first resolving the absolute path of both + // Command matching is performed by first resolving the absolute path of both // the plugin and the name in the allowlist entry using `exec.LookPath`. It // will be called on both, and the resulting strings must be equal. If - // either call to `exec.LookPath` results in an error, the `Name` check + // either call to `exec.LookPath` results in an error, the `Command` check // will be considered a failure. - Name string + Command string } // AliasOverride stores the alias definitions. diff --git a/pkg/config/v1beta1/types.go b/pkg/config/v1beta1/types.go index e1d5409a1..575840b6f 100644 --- a/pkg/config/v1beta1/types.go +++ b/pkg/config/v1beta1/types.go @@ -121,7 +121,14 @@ type AllowlistEntry struct { // will be called on both, and the resulting strings must be equal. If // either call to `exec.LookPath` results in an error, the `Name` check // will be considered a failure. + // Deprecated: use Command instead Name string `json:"name"` + // Name matching is performed by first resolving the absolute path of both + // the plugin and the name in the allowlist entry using `exec.LookPath`. It + // will be called on both, and the resulting strings must be equal. If + // either call to `exec.LookPath` results in an error, the `Name` check + // will be considered a failure. + Command string `json:"command"` } // AliasOverride stores the alias definitions. diff --git a/pkg/kuberc/kuberc_test.go b/pkg/kuberc/kuberc_test.go index 01afec489..a1b6cd3a0 100644 --- a/pkg/kuberc/kuberc_test.go +++ b/pkg/kuberc/kuberc_test.go @@ -2978,8 +2978,8 @@ users: return &config.Preference{ CredentialPluginPolicy: config.CredentialPluginPolicy("Allowlist"), CredentialPluginAllowlist: []config.AllowlistEntry{ - {Name: "bar"}, - {Name: "baz"}, + {Command: "bar"}, + {Command: "baz"}, }, }, nil } From 578e4fc63ea9afeeadc274c3dccd5faaa0376ca2 Mon Sep 17 00:00:00 2001 From: Peter Engelbert Date: Thu, 26 Feb 2026 13:18:18 -0500 Subject: [PATCH 2/8] Update conversion func for AllowlistEntry Convert `Name` to `Command` where necessary, and error if both are provided. Signed-off-by: Peter Engelbert Kubernetes-commit: cabfc886386f5a3f90a85f3ec0b597e17621862d --- pkg/config/v1beta1/conversion.go | 48 +++++++++++++++ pkg/config/v1beta1/zz_generated.conversion.go | 59 +++++++++++-------- 2 files changed, 83 insertions(+), 24 deletions(-) create mode 100644 pkg/config/v1beta1/conversion.go diff --git a/pkg/config/v1beta1/conversion.go b/pkg/config/v1beta1/conversion.go new file mode 100644 index 000000000..c56b126f5 --- /dev/null +++ b/pkg/config/v1beta1/conversion.go @@ -0,0 +1,48 @@ +/* +Copyright 2025 The Kubernetes Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package v1beta1 + +import ( + "fmt" + + conversion "k8s.io/apimachinery/pkg/conversion" + config "k8s.io/kubectl/pkg/config" +) + +func Convert_config_AllowlistEntry_To_v1beta1_AllowlistEntry(in *config.AllowlistEntry, out *AllowlistEntry, s conversion.Scope) error { + in.Command = out.Command + + return nil +} + +// The internal AllowlistEntry type does not have the `Name` field, which is deprecated as of v1.36. Convert `Name` to `Command` where possible, and return an error if both `Name` and `Command` are supplied. +func Convert_v1beta1_AllowlistEntry_To_config_AllowlistEntry(in *AllowlistEntry, out *config.AllowlistEntry, s conversion.Scope) error { + if len(in.Name) != 0 && len(in.Command) != 0 { + return fmt.Errorf("both `Name` and `Command` were supplied. `Name` is deprecated, use `Command` instead.") + } + + // when both `Name` and `Command` are empty, propagate the empty value and + // allow validation to catch it later since it's a validation error, not a + // conversion error + cmd := in.Command + if len(in.Name) != 0 { + cmd = in.Name + } + + out.Command = cmd + return nil +} diff --git a/pkg/config/v1beta1/zz_generated.conversion.go b/pkg/config/v1beta1/zz_generated.conversion.go index dcbe99481..f0516ce95 100644 --- a/pkg/config/v1beta1/zz_generated.conversion.go +++ b/pkg/config/v1beta1/zz_generated.conversion.go @@ -46,16 +46,6 @@ func RegisterConversions(s *runtime.Scheme) error { }); err != nil { return err } - if err := s.AddGeneratedConversionFunc((*AllowlistEntry)(nil), (*config.AllowlistEntry)(nil), func(a, b interface{}, scope conversion.Scope) error { - return Convert_v1beta1_AllowlistEntry_To_config_AllowlistEntry(a.(*AllowlistEntry), b.(*config.AllowlistEntry), scope) - }); err != nil { - return err - } - if err := s.AddGeneratedConversionFunc((*config.AllowlistEntry)(nil), (*AllowlistEntry)(nil), func(a, b interface{}, scope conversion.Scope) error { - return Convert_config_AllowlistEntry_To_v1beta1_AllowlistEntry(a.(*config.AllowlistEntry), b.(*AllowlistEntry), scope) - }); err != nil { - return err - } if err := s.AddGeneratedConversionFunc((*CommandDefaults)(nil), (*config.CommandDefaults)(nil), func(a, b interface{}, scope conversion.Scope) error { return Convert_v1beta1_CommandDefaults_To_config_CommandDefaults(a.(*CommandDefaults), b.(*config.CommandDefaults), scope) }); err != nil { @@ -86,6 +76,16 @@ func RegisterConversions(s *runtime.Scheme) error { }); err != nil { return err } + if err := s.AddConversionFunc((*config.AllowlistEntry)(nil), (*AllowlistEntry)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_config_AllowlistEntry_To_v1beta1_AllowlistEntry(a.(*config.AllowlistEntry), b.(*AllowlistEntry), scope) + }); err != nil { + return err + } + if err := s.AddConversionFunc((*AllowlistEntry)(nil), (*config.AllowlistEntry)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_v1beta1_AllowlistEntry_To_config_AllowlistEntry(a.(*AllowlistEntry), b.(*config.AllowlistEntry), scope) + }); err != nil { + return err + } return nil } @@ -118,25 +118,16 @@ func Convert_config_AliasOverride_To_v1beta1_AliasOverride(in *config.AliasOverr } func autoConvert_v1beta1_AllowlistEntry_To_config_AllowlistEntry(in *AllowlistEntry, out *config.AllowlistEntry, s conversion.Scope) error { - out.Name = in.Name + // WARNING: in.Name requires manual conversion: does not exist in peer-type + out.Command = in.Command return nil } -// Convert_v1beta1_AllowlistEntry_To_config_AllowlistEntry is an autogenerated conversion function. -func Convert_v1beta1_AllowlistEntry_To_config_AllowlistEntry(in *AllowlistEntry, out *config.AllowlistEntry, s conversion.Scope) error { - return autoConvert_v1beta1_AllowlistEntry_To_config_AllowlistEntry(in, out, s) -} - func autoConvert_config_AllowlistEntry_To_v1beta1_AllowlistEntry(in *config.AllowlistEntry, out *AllowlistEntry, s conversion.Scope) error { - out.Name = in.Name + out.Command = in.Command return nil } -// Convert_config_AllowlistEntry_To_v1beta1_AllowlistEntry is an autogenerated conversion function. -func Convert_config_AllowlistEntry_To_v1beta1_AllowlistEntry(in *config.AllowlistEntry, out *AllowlistEntry, s conversion.Scope) error { - return autoConvert_config_AllowlistEntry_To_v1beta1_AllowlistEntry(in, out, s) -} - func autoConvert_v1beta1_CommandDefaults_To_config_CommandDefaults(in *CommandDefaults, out *config.CommandDefaults, s conversion.Scope) error { out.Command = in.Command out.Options = *(*[]config.CommandOptionDefault)(unsafe.Pointer(&in.Options)) @@ -185,7 +176,17 @@ func autoConvert_v1beta1_Preference_To_config_Preference(in *Preference, out *co out.Defaults = *(*[]config.CommandDefaults)(unsafe.Pointer(&in.Defaults)) out.Aliases = *(*[]config.AliasOverride)(unsafe.Pointer(&in.Aliases)) out.CredentialPluginPolicy = config.CredentialPluginPolicy(in.CredentialPluginPolicy) - out.CredentialPluginAllowlist = *(*[]config.AllowlistEntry)(unsafe.Pointer(&in.CredentialPluginAllowlist)) + if in.CredentialPluginAllowlist != nil { + in, out := &in.CredentialPluginAllowlist, &out.CredentialPluginAllowlist + *out = make([]config.AllowlistEntry, len(*in)) + for i := range *in { + if err := Convert_v1beta1_AllowlistEntry_To_config_AllowlistEntry(&(*in)[i], &(*out)[i], s); err != nil { + return err + } + } + } else { + out.CredentialPluginAllowlist = nil + } return nil } @@ -198,7 +199,17 @@ func autoConvert_config_Preference_To_v1beta1_Preference(in *config.Preference, out.Defaults = *(*[]CommandDefaults)(unsafe.Pointer(&in.Defaults)) out.Aliases = *(*[]AliasOverride)(unsafe.Pointer(&in.Aliases)) out.CredentialPluginPolicy = CredentialPluginPolicy(in.CredentialPluginPolicy) - out.CredentialPluginAllowlist = *(*[]AllowlistEntry)(unsafe.Pointer(&in.CredentialPluginAllowlist)) + if in.CredentialPluginAllowlist != nil { + in, out := &in.CredentialPluginAllowlist, &out.CredentialPluginAllowlist + *out = make([]AllowlistEntry, len(*in)) + for i := range *in { + if err := Convert_config_AllowlistEntry_To_v1beta1_AllowlistEntry(&(*in)[i], &(*out)[i], s); err != nil { + return err + } + } + } else { + out.CredentialPluginAllowlist = nil + } return nil } From c3cd307a41d7a21ceaa7443d242c4c94238436c2 Mon Sep 17 00:00:00 2001 From: Peter Engelbert Date: Thu, 26 Feb 2026 13:27:46 -0500 Subject: [PATCH 3/8] Rename AllowlistEntry clientcmd.Name to Command Signed-off-by: Peter Engelbert Kubernetes-commit: 505b937babc9ab0061ed346ec0278a3a605664ac --- pkg/kuberc/kuberc_test.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkg/kuberc/kuberc_test.go b/pkg/kuberc/kuberc_test.go index a1b6cd3a0..029c737d8 100644 --- a/pkg/kuberc/kuberc_test.go +++ b/pkg/kuberc/kuberc_test.go @@ -2992,8 +2992,8 @@ users: require.NotNil(t, cfg, "rest config") require.NotNil(t, cfg.ExecProvider, "exec config") require.Equal(t, clientcmdapi.PolicyType("Allowlist"), cfg.ExecProvider.PluginPolicy.PolicyType) - require.Equal(t, "bar", cfg.ExecProvider.PluginPolicy.Allowlist[0].Name) - require.Equal(t, "baz", cfg.ExecProvider.PluginPolicy.Allowlist[1].Name) + require.Equal(t, "bar", cfg.ExecProvider.PluginPolicy.Allowlist[0].Command) + require.Equal(t, "baz", cfg.ExecProvider.PluginPolicy.Allowlist[1].Command) }) type pluginPolicyTest struct { From f92446bc60371bfb313a21dc5da1c6e5e3f5645d Mon Sep 17 00:00:00 2001 From: Peter Engelbert Date: Thu, 26 Feb 2026 13:40:30 -0500 Subject: [PATCH 4/8] Update kuberc plugin policy tests * Add test to ensure error when both `name` and `command` are supplied * Add test to ensure autoconversion of `name` to `command` * Change the rest of the `name` fields to `command` since `name` is deprecated Signed-off-by: Peter Engelbert Kubernetes-commit: 8203f2b53f6070bf16e21941033b64c15c24b23b --- pkg/kuberc/kuberc_test.go | 39 ++++++++++++++++++++++++++++++--------- 1 file changed, 30 insertions(+), 9 deletions(-) diff --git a/pkg/kuberc/kuberc_test.go b/pkg/kuberc/kuberc_test.go index 029c737d8..04a2f93d3 100644 --- a/pkg/kuberc/kuberc_test.go +++ b/pkg/kuberc/kuberc_test.go @@ -3028,7 +3028,7 @@ kind: Preference apiVersion: kubectl.config.k8s.io/v1beta1 credentialPluginPolicy: "foo" credentialPluginAllowlist: -- name: "bar" +- command: "bar" `, }, { @@ -3057,8 +3057,8 @@ credentialPluginAllowlist: [] kind: Preference apiVersion: kubectl.config.k8s.io/v1beta1 credentialPluginAllowlist: -- name: "bar" -- name: "baz" +- command: "bar" +- command: "baz" `, }, { @@ -3069,8 +3069,8 @@ kind: Preference apiVersion: kubectl.config.k8s.io/v1beta1 credentialPluginPolicy: "AllowAll" credentialPluginAllowlist: []clientcmdapi.AllowlistEntry{ -- name: "bar" -- name: "baz" +- command: "bar" +- command: "baz" `, }, { @@ -3081,8 +3081,8 @@ kind: Preference apiVersion: kubectl.config.k8s.io/v1beta1 credentialPluginPolicy: "DenyAll" credentialPluginAllowlist: -- name: "bar" -- name: "baz" +- command: "bar" +- command: "baz" `, }, { @@ -3103,8 +3103,8 @@ kind: Preference apiVersion: kubectl.config.k8s.io/v1beta1 credentialPluginPolicy: "Allowlist" credentialPluginAllowlist: -- name: "foo" -- name: "" +- command: "foo" +- command: "" `, }, { @@ -3114,7 +3114,28 @@ credentialPluginAllowlist: kind: Preference credentialPluginPolicy: "Allowlist" credentialPluginAllowlist: +- command: "foo" +`, + }, + { + name: "allowlist-policy-name-converts-to-command", + shouldErr: false, + kuberc: `apiVersion: kubectl.config.k8s.io/v1beta1 +kind: Preference +credentialPluginPolicy: "Allowlist" +credentialPluginAllowlist: - name: "foo" +`, + }, + { + name: "allowlist-policy-with-both-name-and-command", + shouldErr: true, + kuberc: `apiVersion: kubectl.config.k8s.io/v1beta1 +kind: Preference +credentialPluginPolicy: "Allowlist" +credentialPluginAllowlist: +- name: "foo" + command: "bar" `, }, { From 93c05e4e7ad7d66797ebe6d4fbba058e7754f74a Mon Sep 17 00:00:00 2001 From: Peter Engelbert Date: Thu, 26 Feb 2026 13:46:47 -0500 Subject: [PATCH 5/8] Update doc comment Signed-off-by: Peter Engelbert Kubernetes-commit: cede69d55800204a59640104f31417ebb4e2d563 --- pkg/config/v1beta1/types.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkg/config/v1beta1/types.go b/pkg/config/v1beta1/types.go index 575840b6f..7eaa4e6d8 100644 --- a/pkg/config/v1beta1/types.go +++ b/pkg/config/v1beta1/types.go @@ -123,10 +123,10 @@ type AllowlistEntry struct { // will be considered a failure. // Deprecated: use Command instead Name string `json:"name"` - // Name matching is performed by first resolving the absolute path of both + // Command matching is performed by first resolving the absolute path of both // the plugin and the name in the allowlist entry using `exec.LookPath`. It // will be called on both, and the resulting strings must be equal. If - // either call to `exec.LookPath` results in an error, the `Name` check + // either call to `exec.LookPath` results in an error, the `Command` check // will be considered a failure. Command string `json:"command"` } From b81eec6548f9781b86f27ff844cc44a000e3dd88 Mon Sep 17 00:00:00 2001 From: Peter Engelbert Date: Thu, 26 Feb 2026 15:18:34 -0500 Subject: [PATCH 6/8] Run openapi codegen Signed-off-by: Peter Engelbert Kubernetes-commit: 64c0d51314257389603bf2166a1c6675a153e336 --- pkg/config/v1beta1/conversion.go | 2 +- pkg/config/v1beta1/types.go | 3 ++- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/pkg/config/v1beta1/conversion.go b/pkg/config/v1beta1/conversion.go index c56b126f5..c6eb9a49e 100644 --- a/pkg/config/v1beta1/conversion.go +++ b/pkg/config/v1beta1/conversion.go @@ -32,7 +32,7 @@ func Convert_config_AllowlistEntry_To_v1beta1_AllowlistEntry(in *config.Allowlis // The internal AllowlistEntry type does not have the `Name` field, which is deprecated as of v1.36. Convert `Name` to `Command` where possible, and return an error if both `Name` and `Command` are supplied. func Convert_v1beta1_AllowlistEntry_To_config_AllowlistEntry(in *AllowlistEntry, out *config.AllowlistEntry, s conversion.Scope) error { if len(in.Name) != 0 && len(in.Command) != 0 { - return fmt.Errorf("both `Name` and `Command` were supplied. `Name` is deprecated, use `Command` instead.") + return fmt.Errorf("both `Name` and `Command` were supplied. `Name` is deprecated, use `Command` instead") } // when both `Name` and `Command` are empty, propagate the empty value and diff --git a/pkg/config/v1beta1/types.go b/pkg/config/v1beta1/types.go index 7eaa4e6d8..51757a47e 100644 --- a/pkg/config/v1beta1/types.go +++ b/pkg/config/v1beta1/types.go @@ -116,12 +116,13 @@ const ( // the logical AND of all checks corresponding to the specified fields within // the entry. type AllowlistEntry struct { + // Deprecated: use Command instead + // Name matching is performed by first resolving the absolute path of both // the plugin and the name in the allowlist entry using `exec.LookPath`. It // will be called on both, and the resulting strings must be equal. If // either call to `exec.LookPath` results in an error, the `Name` check // will be considered a failure. - // Deprecated: use Command instead Name string `json:"name"` // Command matching is performed by first resolving the absolute path of both // the plugin and the name in the allowlist entry using `exec.LookPath`. It From f336bc1fb3b6180317d2dad383ab511775880a41 Mon Sep 17 00:00:00 2001 From: Peter Engelbert Date: Thu, 26 Feb 2026 16:10:08 -0500 Subject: [PATCH 7/8] Improve AllowlistEntry conversion logic Allow both `Name` and `Command` when the values are identical, but not when they differ. Additionally: - Add unit test verifying the above - Add `omitempty` json tag to `Name` and `Command` fields in `AllowlistEntry` struct - Run openapi codegen - Remove year from boilerplate comments Signed-off-by: Peter Engelbert Kubernetes-commit: e3642120630421d3d0756908fa4661a7d13c3aa4 --- pkg/config/v1beta1/conversion.go | 29 +++++++++++++++-------------- pkg/config/v1beta1/types.go | 4 ++-- pkg/kuberc/kuberc_test.go | 13 ++++++++++++- 3 files changed, 29 insertions(+), 17 deletions(-) diff --git a/pkg/config/v1beta1/conversion.go b/pkg/config/v1beta1/conversion.go index c6eb9a49e..a862605cc 100644 --- a/pkg/config/v1beta1/conversion.go +++ b/pkg/config/v1beta1/conversion.go @@ -1,5 +1,5 @@ /* -Copyright 2025 The Kubernetes Authors. +Copyright The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. @@ -24,25 +24,26 @@ import ( ) func Convert_config_AllowlistEntry_To_v1beta1_AllowlistEntry(in *config.AllowlistEntry, out *AllowlistEntry, s conversion.Scope) error { - in.Command = out.Command - - return nil + return autoConvert_config_AllowlistEntry_To_v1beta1_AllowlistEntry(in, out, s) } // The internal AllowlistEntry type does not have the `Name` field, which is deprecated as of v1.36. Convert `Name` to `Command` where possible, and return an error if both `Name` and `Command` are supplied. func Convert_v1beta1_AllowlistEntry_To_config_AllowlistEntry(in *AllowlistEntry, out *config.AllowlistEntry, s conversion.Scope) error { - if len(in.Name) != 0 && len(in.Command) != 0 { - return fmt.Errorf("both `Name` and `Command` were supplied. `Name` is deprecated, use `Command` instead") + if err := autoConvert_v1beta1_AllowlistEntry_To_config_AllowlistEntry(in, out, s); err != nil { + return err } - // when both `Name` and `Command` are empty, propagate the empty value and - // allow validation to catch it later since it's a validation error, not a - // conversion error - cmd := in.Command - if len(in.Name) != 0 { - cmd = in.Name + switch { + case len(in.Name) != 0 && len(in.Command) != 0 && in.Name != in.Command: + return fmt.Errorf("both `Name` and `Command` were supplied with different values. `Name` is deprecated, use `Command` instead") + case len(in.Command) != 0: + out.Command = in.Command + case len(in.Name) != 0: + out.Command = in.Name + default: + // both `Name` and `Command` are empty, propagate the empty value and + // allow validation to catch it later since it's a validation error, not a + // conversion error } - - out.Command = cmd return nil } diff --git a/pkg/config/v1beta1/types.go b/pkg/config/v1beta1/types.go index 51757a47e..7b2aa17b2 100644 --- a/pkg/config/v1beta1/types.go +++ b/pkg/config/v1beta1/types.go @@ -123,13 +123,13 @@ type AllowlistEntry struct { // will be called on both, and the resulting strings must be equal. If // either call to `exec.LookPath` results in an error, the `Name` check // will be considered a failure. - Name string `json:"name"` + Name string `json:"name,omitempty"` // Command matching is performed by first resolving the absolute path of both // the plugin and the name in the allowlist entry using `exec.LookPath`. It // will be called on both, and the resulting strings must be equal. If // either call to `exec.LookPath` results in an error, the `Command` check // will be considered a failure. - Command string `json:"command"` + Command string `json:"command,omitempty"` } // AliasOverride stores the alias definitions. diff --git a/pkg/kuberc/kuberc_test.go b/pkg/kuberc/kuberc_test.go index 04a2f93d3..567ea5871 100644 --- a/pkg/kuberc/kuberc_test.go +++ b/pkg/kuberc/kuberc_test.go @@ -3128,7 +3128,7 @@ credentialPluginAllowlist: `, }, { - name: "allowlist-policy-with-both-name-and-command", + name: "allowlist-policy-with-both-name-and-command-having-different-values", shouldErr: true, kuberc: `apiVersion: kubectl.config.k8s.io/v1beta1 kind: Preference @@ -3136,6 +3136,17 @@ credentialPluginPolicy: "Allowlist" credentialPluginAllowlist: - name: "foo" command: "bar" +`, + }, + { + name: "allowlist-policy-with-both-name-and-command-having-the-same-value", + shouldErr: false, + kuberc: `apiVersion: kubectl.config.k8s.io/v1beta1 +kind: Preference +credentialPluginPolicy: "Allowlist" +credentialPluginAllowlist: +- name: "foo" + command: "foo" `, }, { From aea8c6a8d815ef5e5e1ecb4247ab3d7c96cfc082 Mon Sep 17 00:00:00 2001 From: Peter Engelbert Date: Thu, 26 Feb 2026 16:30:03 -0500 Subject: [PATCH 8/8] Fix Deprecation message in doc comment Signed-off-by: Peter Engelbert Kubernetes-commit: 71a7aeaff0f57dc53067c32f418f06c98cbbe7ee --- pkg/config/v1beta1/types.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkg/config/v1beta1/types.go b/pkg/config/v1beta1/types.go index 7b2aa17b2..f019bbb37 100644 --- a/pkg/config/v1beta1/types.go +++ b/pkg/config/v1beta1/types.go @@ -116,13 +116,13 @@ const ( // the logical AND of all checks corresponding to the specified fields within // the entry. type AllowlistEntry struct { - // Deprecated: use Command instead - // Name matching is performed by first resolving the absolute path of both // the plugin and the name in the allowlist entry using `exec.LookPath`. It // will be called on both, and the resulting strings must be equal. If // either call to `exec.LookPath` results in an error, the `Name` check // will be considered a failure. + // + // Deprecated: use Command instead. Name string `json:"name,omitempty"` // Command matching is performed by first resolving the absolute path of both // the plugin and the name in the allowlist entry using `exec.LookPath`. It