Binary Authorization V1 API - Class Google::Cloud::BinaryAuthorization::V1::Policy (v0.8.0)

Reference documentation and code samples for the Binary Authorization V1 API class Google::Cloud::BinaryAuthorization::V1::Policy.

A policy for container image binary authorization.

Inherits

Object

Extended By

Google::Protobuf::MessageExts::ClassMethods

Includes

Google::Protobuf::MessageExts

Methods

#admission_whitelist_patterns

def admission_whitelist_patterns() -> ::Array<::Google::Cloud::BinaryAuthorization::V1::AdmissionWhitelistPattern>

Returns

(::Array<::Google::Cloud::BinaryAuthorization::V1::AdmissionWhitelistPattern>) — Optional. Admission policy allowlisting. A matching admission request will always be permitted. This feature is typically used to exclude Google or third-party infrastructure images from Binary Authorization policies.

#admission_whitelist_patterns=

def admission_whitelist_patterns=(value) -> ::Array<::Google::Cloud::BinaryAuthorization::V1::AdmissionWhitelistPattern>

Parameter

value (::Array<::Google::Cloud::BinaryAuthorization::V1::AdmissionWhitelistPattern>) — Optional. Admission policy allowlisting. A matching admission request will always be permitted. This feature is typically used to exclude Google or third-party infrastructure images from Binary Authorization policies.

Returns

(::Array<::Google::Cloud::BinaryAuthorization::V1::AdmissionWhitelistPattern>) — Optional. Admission policy allowlisting. A matching admission request will always be permitted. This feature is typically used to exclude Google or third-party infrastructure images from Binary Authorization policies.

#cluster_admission_rules

def cluster_admission_rules() -> ::Google::Protobuf::Map{::String => ::Google::Cloud::BinaryAuthorization::V1::AdmissionRule}

Returns

(::Google::Protobuf::Map{::String => ::Google::Cloud::BinaryAuthorization::V1::AdmissionRule}) — Optional. Per-cluster admission rules. Cluster spec format: location.clusterId. There can be at most one admission rule per cluster spec. A location is either a compute zone (e.g. us-central1-a) or a region (e.g. us-central1). For clusterId syntax restrictions see https://cloud.google.com/container-engine/reference/rest/v1/projects.zones.clusters.

#cluster_admission_rules=

def cluster_admission_rules=(value) -> ::Google::Protobuf::Map{::String => ::Google::Cloud::BinaryAuthorization::V1::AdmissionRule}

Parameter

value (::Google::Protobuf::Map{::String => ::Google::Cloud::BinaryAuthorization::V1::AdmissionRule}) — Optional. Per-cluster admission rules. Cluster spec format: location.clusterId. There can be at most one admission rule per cluster spec. A location is either a compute zone (e.g. us-central1-a) or a region (e.g. us-central1). For clusterId syntax restrictions see https://cloud.google.com/container-engine/reference/rest/v1/projects.zones.clusters.

Returns

(::Google::Protobuf::Map{::String => ::Google::Cloud::BinaryAuthorization::V1::AdmissionRule}) — Optional. Per-cluster admission rules. Cluster spec format: location.clusterId. There can be at most one admission rule per cluster spec. A location is either a compute zone (e.g. us-central1-a) or a region (e.g. us-central1). For clusterId syntax restrictions see https://cloud.google.com/container-engine/reference/rest/v1/projects.zones.clusters.

#default_admission_rule

def default_admission_rule() -> ::Google::Cloud::BinaryAuthorization::V1::AdmissionRule

Returns

(::Google::Cloud::BinaryAuthorization::V1::AdmissionRule) — Required. Default admission rule for a cluster without a per-cluster, per- kubernetes-service-account, or per-istio-service-identity admission rule.

#default_admission_rule=

def default_admission_rule=(value) -> ::Google::Cloud::BinaryAuthorization::V1::AdmissionRule

Parameter

value (::Google::Cloud::BinaryAuthorization::V1::AdmissionRule) — Required. Default admission rule for a cluster without a per-cluster, per- kubernetes-service-account, or per-istio-service-identity admission rule.

Returns

(::Google::Cloud::BinaryAuthorization::V1::AdmissionRule) — Required. Default admission rule for a cluster without a per-cluster, per- kubernetes-service-account, or per-istio-service-identity admission rule.

#description

def description() -> ::String

Returns

(::String) — Optional. A descriptive comment.

#description=

def description=(value) -> ::String

Parameter

value (::String) — Optional. A descriptive comment.

Returns

(::String) — Optional. A descriptive comment.

#global_policy_evaluation_mode

def global_policy_evaluation_mode() -> ::Google::Cloud::BinaryAuthorization::V1::Policy::GlobalPolicyEvaluationMode

Returns

(::Google::Cloud::BinaryAuthorization::V1::Policy::GlobalPolicyEvaluationMode) — Optional. Controls the evaluation of a Google-maintained global admission policy for common system-level images. Images not covered by the global policy will be subject to the project admission policy. This setting has no effect when specified inside a global admission policy.

#global_policy_evaluation_mode=

def global_policy_evaluation_mode=(value) -> ::Google::Cloud::BinaryAuthorization::V1::Policy::GlobalPolicyEvaluationMode

Parameter

value (::Google::Cloud::BinaryAuthorization::V1::Policy::GlobalPolicyEvaluationMode) — Optional. Controls the evaluation of a Google-maintained global admission policy for common system-level images. Images not covered by the global policy will be subject to the project admission policy. This setting has no effect when specified inside a global admission policy.

Returns

(::Google::Cloud::BinaryAuthorization::V1::Policy::GlobalPolicyEvaluationMode) — Optional. Controls the evaluation of a Google-maintained global admission policy for common system-level images. Images not covered by the global policy will be subject to the project admission policy. This setting has no effect when specified inside a global admission policy.

#istio_service_identity_admission_rules

def istio_service_identity_admission_rules() -> ::Google::Protobuf::Map{::String => ::Google::Cloud::BinaryAuthorization::V1::AdmissionRule}

Returns

(::Google::Protobuf::Map{::String => ::Google::Cloud::BinaryAuthorization::V1::AdmissionRule}) — Optional. Per-istio-service-identity admission rules. Istio service identity spec format: spiffe://

#istio_service_identity_admission_rules=

def istio_service_identity_admission_rules=(value) -> ::Google::Protobuf::Map{::String => ::Google::Cloud::BinaryAuthorization::V1::AdmissionRule}

Parameter

value (::Google::Protobuf::Map{::String => ::Google::Cloud::BinaryAuthorization::V1::AdmissionRule}) — Optional. Per-istio-service-identity admission rules. Istio service identity spec format: spiffe://

Returns

(::Google::Protobuf::Map{::String => ::Google::Cloud::BinaryAuthorization::V1::AdmissionRule}) — Optional. Per-istio-service-identity admission rules. Istio service identity spec format: spiffe://

#kubernetes_namespace_admission_rules

def kubernetes_namespace_admission_rules() -> ::Google::Protobuf::Map{::String => ::Google::Cloud::BinaryAuthorization::V1::AdmissionRule}

Returns

(::Google::Protobuf::Map{::String => ::Google::Cloud::BinaryAuthorization::V1::AdmissionRule}) — Optional. Per-kubernetes-namespace admission rules. K8s namespace spec format: [a-z.-]+, e.g. 'some-namespace'

#kubernetes_namespace_admission_rules=

def kubernetes_namespace_admission_rules=(value) -> ::Google::Protobuf::Map{::String => ::Google::Cloud::BinaryAuthorization::V1::AdmissionRule}

Parameter

value (::Google::Protobuf::Map{::String => ::Google::Cloud::BinaryAuthorization::V1::AdmissionRule}) — Optional. Per-kubernetes-namespace admission rules. K8s namespace spec format: [a-z.-]+, e.g. 'some-namespace'

Returns

(::Google::Protobuf::Map{::String => ::Google::Cloud::BinaryAuthorization::V1::AdmissionRule}) — Optional. Per-kubernetes-namespace admission rules. K8s namespace spec format: [a-z.-]+, e.g. 'some-namespace'

#kubernetes_service_account_admission_rules

def kubernetes_service_account_admission_rules() -> ::Google::Protobuf::Map{::String => ::Google::Cloud::BinaryAuthorization::V1::AdmissionRule}

Returns

(::Google::Protobuf::Map{::String => ::Google::Cloud::BinaryAuthorization::V1::AdmissionRule}) — Optional. Per-kubernetes-service-account admission rules. Service account spec format: namespace:serviceaccount. e.g. 'test-ns:default'

#kubernetes_service_account_admission_rules=

def kubernetes_service_account_admission_rules=(value) -> ::Google::Protobuf::Map{::String => ::Google::Cloud::BinaryAuthorization::V1::AdmissionRule}

Parameter

value (::Google::Protobuf::Map{::String => ::Google::Cloud::BinaryAuthorization::V1::AdmissionRule}) — Optional. Per-kubernetes-service-account admission rules. Service account spec format: namespace:serviceaccount. e.g. 'test-ns:default'

Returns

(::Google::Protobuf::Map{::String => ::Google::Cloud::BinaryAuthorization::V1::AdmissionRule}) — Optional. Per-kubernetes-service-account admission rules. Service account spec format: namespace:serviceaccount. e.g. 'test-ns:default'

#name

def name() -> ::String

Returns

(::String) — Output only. The resource name, in the format projects/*/policy. There is at most one policy per project.

#update_time

def update_time() -> ::Google::Protobuf::Timestamp

Returns

(::Google::Protobuf::Timestamp) — Output only. Time when the policy was last updated.