UnblockRequest
UnblockRequest is a user's request, made on the block page, to allow a blocked name.
UnblockRequest is a user's request, made on the block page, to allow a blocked name. Administrators approve (which adds an allow entry) or deny it; the leader expires and prunes old requests (docs/deploy/blocking-page.md, "Unblock requests").
| API version | kudurru.io/v1alpha1 |
| Kind | UnblockRequest |
| Scope | Namespaced |
| Resource | unblockrequests.kudurru.io |
| Short names | ubr |
| Subresources | status |
Columns of kubectl get unblockrequests:
| Column | Type | Value |
|---|---|---|
| DOMAIN | string | .spec.domain |
| CLIENT | string | .spec.client |
| STATE | string | .status.state |
| AGE | date | .metadata.creationTimestamp |
Spec
UnblockRequestSpec is what a user asked for on the block page. The block page writes it; administrators decide through the API (status).
| Field | Type | Description |
|---|---|---|
spec.block | object | Block is why the name was blocked; nil when the block page did not know. |
spec.block.kind | string | Kind is list, service, safesearch, policy (allow-only) or cname. Length: at most 32 |
spec.block.list | string | List is the deciding list ("ns/name", "service:<id>", "safesearch:<engine>"). Length: at most 300 |
spec.block.policy | string | Policy is the policy that applied to the client, "ns/name". Length: at most 300 |
spec.block.rule | string | Rule is the matching rule text. Length: at most 1024 |
spec.client | string | Client is the requester as querylog.privacy allows recording it: the address (full), its /24 or /48 (prefix), or empty (hidden). Length: at most 64 |
spec.clientPrivacy | string | ClientPrivacy says how Client was recorded. One of: full, prefix, hidden |
spec.contact | string | Length: at most 254 |
spec.domain | string | Required. Domain is the blocked name, from the Host header or TLS server name of the block page request (never from the form). Length: 1 to 253 |
spec.groups | []string | Groups are the client's ClientGroups ("ns/name") at request time. Items: at most 16 |
spec.node | string | Node is the node whose block page took the request. Length: at most 253 |
spec.policies | []string | Policies are the policies that applied to the client, highest priority first. Items: at most 16 |
spec.reason | string | Reason is the user's explanation (plain text). Length: at most 500 |
spec.requestedAt | string | RequestedAt is the latest submission (the object's creation is the first); Submissions counts them. Format: date-time |
spec.requesterName | string | RequesterName and Contact are what the user typed (plain text). Length: at most 100 |
spec.submissions | integer | Range: at least 0 |
Status
UnblockRequestStatus is the decision.
| Field | Type | Description |
|---|---|---|
status.allow | object | Allow is the allow entry of an approval. |
status.allow.added | boolean | Added is true when this approval added Entry (it was not on the list before); only then does expiry remove it. |
status.allow.entry | string | Required. Length: at most 300 |
status.allow.expiresAt | string | ExpiresAt ends a time-limited approval; nil is permanent. Format: date-time |
status.allow.group | string | Group is the ClientGroup of a group approval, "ns/name". Length: at most 300 |
status.allow.list | string | Required. List is the allow BlockList, "ns/name", and Entry the line in its inline "ui" source. Length: at most 300 |
status.allow.match | string | Required. Match is exact (the name only) or subdomains (the name and below). One of: exact, subdomains |
status.allow.policies | []string | Policies are the policies the list was attached to by this approval. Items: at most 64 |
status.allow.removed | string | Removed is when the expired entry was taken off the list. Format: date-time |
status.allow.scope | string | Required. Scope is everyone (the ui-allow list) or group (ui-allow-<group>). One of: everyone, group |
status.decidedAt | string | Format: date-time |
status.decidedBy | string | DecidedBy is the administrator ("user:alice") or "system" for expiry; DecidedAt when. Length: at most 300 |
status.history | []object | History holds the earlier decisions when the user asked again, oldest first. Items: at most 20 |
status.history[].allow | object | UnblockAllow is the allow entry an approval created. |
status.history[].allow.added | boolean | Added is true when this approval added Entry (it was not on the list before); only then does expiry remove it. |
status.history[].allow.entry | string | Required. Length: at most 300 |
status.history[].allow.expiresAt | string | ExpiresAt ends a time-limited approval; nil is permanent. Format: date-time |
status.history[].allow.group | string | Group is the ClientGroup of a group approval, "ns/name". Length: at most 300 |
status.history[].allow.list | string | Required. List is the allow BlockList, "ns/name", and Entry the line in its inline "ui" source. Length: at most 300 |
status.history[].allow.match | string | Required. Match is exact (the name only) or subdomains (the name and below). One of: exact, subdomains |
status.history[].allow.policies | []string | Policies are the policies the list was attached to by this approval. Items: at most 64 |
status.history[].allow.removed | string | Removed is when the expired entry was taken off the list. Format: date-time |
status.history[].allow.scope | string | Required. Scope is everyone (the ui-allow list) or group (ui-allow-<group>). One of: everyone, group |
status.history[].decidedAt | string | Format: date-time |
status.history[].decidedBy | string | Length: at most 300 |
status.history[].note | string | Length: at most 500 |
status.history[].state | string | Required. UnblockRequestState is the lifecycle state of an UnblockRequest. One of: Pending, Approved, Denied, Expired |
status.note | string | Note is the administrator's note, shown to the user on the block page. Length: at most 500 |
status.state | string | State is Pending (also when empty), Approved, Denied or Expired. One of: Pending, Approved, Denied, Expired |
Example
config/samples/kudurru.io_v1alpha1_unblockrequest.yaml:
# Written by the block page, not by hand: a user asked to allow a blocked
# name. Approve or deny it in the dashboard (Requests) or through
# POST /api/v1/unblockrequests/{namespace}/{name}/approve|deny.
apiVersion: kudurru.io/v1alpha1
kind: UnblockRequest
metadata:
name: ur-3f2a9c1b7d4e6a80
namespace: default
spec:
domain: www.example-shop.com
client: 192.168.1.23
clientPrivacy: full
groups: [default/kids]
policies: [default/kids]
node: kudurru-0
requesterName: Sam
reason: I need it for a school project.
block:
kind: list
list: default/ads
rule: "||example-shop.com^"
policy: default/kids
requestedAt: "2026-10-11T09:30:00Z"
submissions: 1