Class: Google::Cloud::BinaryAuthorization::V1::Policy

Inherits:
Object
  • Object
show all
Extended by:
Protobuf::MessageExts::ClassMethods
Includes:
Protobuf::MessageExts
Defined in:
proto_docs/google/cloud/binaryauthorization/v1/resources.rb

Overview

A policy for container image binary authorization.

Defined Under Namespace

Modules: GlobalPolicyEvaluationMode Classes: ClusterAdmissionRulesEntry, IstioServiceIdentityAdmissionRulesEntry, KubernetesNamespaceAdmissionRulesEntry, KubernetesServiceAccountAdmissionRulesEntry

Instance Attribute Summary collapse

Instance Attribute Details

#admission_whitelist_patterns ⇒ ::Array<::Google::Cloud::BinaryAuthorization::V1::AdmissionWhitelistPattern>

Returns Optional. Admission policy allowlisting. A matching admission request will always be permitted. This feature is typically used to exclude Google or third-party infrastructure images from Binary Authorization policies.

Returns:



74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
 
# File 'proto_docs/google/cloud/binaryauthorization/v1/resources.rb', line 74

class Policy
  include ::Google::Protobuf::MessageExts
  extend ::Google::Protobuf::MessageExts::ClassMethods

  # @!attribute [rw] key
  #   @return [::String]
  # @!attribute [rw] value
  #   @return [::Google::Cloud::BinaryAuthorization::V1::AdmissionRule]
  class ClusterAdmissionRulesEntry
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # @!attribute [rw] key
  #   @return [::String]
  # @!attribute [rw] value
  #   @return [::Google::Cloud::BinaryAuthorization::V1::AdmissionRule]
  class KubernetesNamespaceAdmissionRulesEntry
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # @!attribute [rw] key
  #   @return [::String]
  # @!attribute [rw] value
  #   @return [::Google::Cloud::BinaryAuthorization::V1::AdmissionRule]
  class KubernetesServiceAccountAdmissionRulesEntry
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # @!attribute [rw] key
  #   @return [::String]
  # @!attribute [rw] value
  #   @return [::Google::Cloud::BinaryAuthorization::V1::AdmissionRule]
  class IstioServiceIdentityAdmissionRulesEntry
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  module GlobalPolicyEvaluationMode
    # Not specified: DISABLE is assumed.
    GLOBAL_POLICY_EVALUATION_MODE_UNSPECIFIED = 0

    # Enables system policy evaluation.
    ENABLE = 1

    # Disables system policy evaluation.
    DISABLE = 2
  end
end

#cluster_admission_rules ⇒ ::Google::Protobuf::Map{::String => ::Google::Cloud::BinaryAuthorization::V1::AdmissionRule}

Returns Optional. Per-cluster admission rules. Cluster spec format: location.clusterId. There can be at most one admission rule per cluster spec. A location is either a compute zone (e.g. us-central1-a) or a region (e.g. us-central1). For clusterId syntax restrictions see https://cloud.google.com/container-engine/reference/rest/v1/projects.zones.clusters.

Returns:



74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
 
# File 'proto_docs/google/cloud/binaryauthorization/v1/resources.rb', line 74

class Policy
  include ::Google::Protobuf::MessageExts
  extend ::Google::Protobuf::MessageExts::ClassMethods

  # @!attribute [rw] key
  #   @return [::String]
  # @!attribute [rw] value
  #   @return [::Google::Cloud::BinaryAuthorization::V1::AdmissionRule]
  class ClusterAdmissionRulesEntry
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # @!attribute [rw] key
  #   @return [::String]
  # @!attribute [rw] value
  #   @return [::Google::Cloud::BinaryAuthorization::V1::AdmissionRule]
  class KubernetesNamespaceAdmissionRulesEntry
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # @!attribute [rw] key
  #   @return [::String]
  # @!attribute [rw] value
  #   @return [::Google::Cloud::BinaryAuthorization::V1::AdmissionRule]
  class KubernetesServiceAccountAdmissionRulesEntry
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # @!attribute [rw] key
  #   @return [::String]
  # @!attribute [rw] value
  #   @return [::Google::Cloud::BinaryAuthorization::V1::AdmissionRule]
  class IstioServiceIdentityAdmissionRulesEntry
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  module GlobalPolicyEvaluationMode
    # Not specified: DISABLE is assumed.
    GLOBAL_POLICY_EVALUATION_MODE_UNSPECIFIED = 0

    # Enables system policy evaluation.
    ENABLE = 1

    # Disables system policy evaluation.
    DISABLE = 2
  end
end

#default_admission_rule ⇒ ::Google::Cloud::BinaryAuthorization::V1::AdmissionRule

Returns Required. Default admission rule for a cluster without a per-cluster, per- kubernetes-service-account, or per-istio-service-identity admission rule.

Returns:



74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
 
# File 'proto_docs/google/cloud/binaryauthorization/v1/resources.rb', line 74

class Policy
  include ::Google::Protobuf::MessageExts
  extend ::Google::Protobuf::MessageExts::ClassMethods

  # @!attribute [rw] key
  #   @return [::String]
  # @!attribute [rw] value
  #   @return [::Google::Cloud::BinaryAuthorization::V1::AdmissionRule]
  class ClusterAdmissionRulesEntry
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # @!attribute [rw] key
  #   @return [::String]
  # @!attribute [rw] value
  #   @return [::Google::Cloud::BinaryAuthorization::V1::AdmissionRule]
  class KubernetesNamespaceAdmissionRulesEntry
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # @!attribute [rw] key
  #   @return [::String]
  # @!attribute [rw] value
  #   @return [::Google::Cloud::BinaryAuthorization::V1::AdmissionRule]
  class KubernetesServiceAccountAdmissionRulesEntry
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # @!attribute [rw] key
  #   @return [::String]
  # @!attribute [rw] value
  #   @return [::Google::Cloud::BinaryAuthorization::V1::AdmissionRule]
  class IstioServiceIdentityAdmissionRulesEntry
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  module GlobalPolicyEvaluationMode
    # Not specified: DISABLE is assumed.
    GLOBAL_POLICY_EVALUATION_MODE_UNSPECIFIED = 0

    # Enables system policy evaluation.
    ENABLE = 1

    # Disables system policy evaluation.
    DISABLE = 2
  end
end

#description ⇒ ::String

Returns Optional. A descriptive comment.

Returns:

  • (::String) —

    Optional. A descriptive comment.



74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
 
# File 'proto_docs/google/cloud/binaryauthorization/v1/resources.rb', line 74

class Policy
  include ::Google::Protobuf::MessageExts
  extend ::Google::Protobuf::MessageExts::ClassMethods

  # @!attribute [rw] key
  #   @return [::String]
  # @!attribute [rw] value
  #   @return [::Google::Cloud::BinaryAuthorization::V1::AdmissionRule]
  class ClusterAdmissionRulesEntry
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # @!attribute [rw] key
  #   @return [::String]
  # @!attribute [rw] value
  #   @return [::Google::Cloud::BinaryAuthorization::V1::AdmissionRule]
  class KubernetesNamespaceAdmissionRulesEntry
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # @!attribute [rw] key
  #   @return [::String]
  # @!attribute [rw] value
  #   @return [::Google::Cloud::BinaryAuthorization::V1::AdmissionRule]
  class KubernetesServiceAccountAdmissionRulesEntry
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # @!attribute [rw] key
  #   @return [::String]
  # @!attribute [rw] value
  #   @return [::Google::Cloud::BinaryAuthorization::V1::AdmissionRule]
  class IstioServiceIdentityAdmissionRulesEntry
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  module GlobalPolicyEvaluationMode
    # Not specified: DISABLE is assumed.
    GLOBAL_POLICY_EVALUATION_MODE_UNSPECIFIED = 0

    # Enables system policy evaluation.
    ENABLE = 1

    # Disables system policy evaluation.
    DISABLE = 2
  end
end

#global_policy_evaluation_mode ⇒ ::Google::Cloud::BinaryAuthorization::V1::Policy::GlobalPolicyEvaluationMode

Returns Optional. Controls the evaluation of a Google-maintained global admission policy for common system-level images. Images not covered by the global policy will be subject to the project admission policy. This setting has no effect when specified inside a global admission policy.

Returns:



74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
 
# File 'proto_docs/google/cloud/binaryauthorization/v1/resources.rb', line 74

class Policy
  include ::Google::Protobuf::MessageExts
  extend ::Google::Protobuf::MessageExts::ClassMethods

  # @!attribute [rw] key
  #   @return [::String]
  # @!attribute [rw] value
  #   @return [::Google::Cloud::BinaryAuthorization::V1::AdmissionRule]
  class ClusterAdmissionRulesEntry
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # @!attribute [rw] key
  #   @return [::String]
  # @!attribute [rw] value
  #   @return [::Google::Cloud::BinaryAuthorization::V1::AdmissionRule]
  class KubernetesNamespaceAdmissionRulesEntry
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # @!attribute [rw] key
  #   @return [::String]
  # @!attribute [rw] value
  #   @return [::Google::Cloud::BinaryAuthorization::V1::AdmissionRule]
  class KubernetesServiceAccountAdmissionRulesEntry
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # @!attribute [rw] key
  #   @return [::String]
  # @!attribute [rw] value
  #   @return [::Google::Cloud::BinaryAuthorization::V1::AdmissionRule]
  class IstioServiceIdentityAdmissionRulesEntry
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  module GlobalPolicyEvaluationMode
    # Not specified: DISABLE is assumed.
    GLOBAL_POLICY_EVALUATION_MODE_UNSPECIFIED = 0

    # Enables system policy evaluation.
    ENABLE = 1

    # Disables system policy evaluation.
    DISABLE = 2
  end
end

#istio_service_identity_admission_rules ⇒ ::Google::Protobuf::Map{::String => ::Google::Cloud::BinaryAuthorization::V1::AdmissionRule}

Returns Optional. Per-istio-service-identity admission rules. Istio service identity spec format: spiffe:///ns//sa/ or /ns//sa/ e.g. spiffe://example.com/ns/test-ns/sa/default.

Returns:



74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
 
# File 'proto_docs/google/cloud/binaryauthorization/v1/resources.rb', line 74

class Policy
  include ::Google::Protobuf::MessageExts
  extend ::Google::Protobuf::MessageExts::ClassMethods

  # @!attribute [rw] key
  #   @return [::String]
  # @!attribute [rw] value
  #   @return [::Google::Cloud::BinaryAuthorization::V1::AdmissionRule]
  class ClusterAdmissionRulesEntry
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # @!attribute [rw] key
  #   @return [::String]
  # @!attribute [rw] value
  #   @return [::Google::Cloud::BinaryAuthorization::V1::AdmissionRule]
  class KubernetesNamespaceAdmissionRulesEntry
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # @!attribute [rw] key
  #   @return [::String]
  # @!attribute [rw] value
  #   @return [::Google::Cloud::BinaryAuthorization::V1::AdmissionRule]
  class KubernetesServiceAccountAdmissionRulesEntry
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # @!attribute [rw] key
  #   @return [::String]
  # @!attribute [rw] value
  #   @return [::Google::Cloud::BinaryAuthorization::V1::AdmissionRule]
  class IstioServiceIdentityAdmissionRulesEntry
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  module GlobalPolicyEvaluationMode
    # Not specified: DISABLE is assumed.
    GLOBAL_POLICY_EVALUATION_MODE_UNSPECIFIED = 0

    # Enables system policy evaluation.
    ENABLE = 1

    # Disables system policy evaluation.
    DISABLE = 2
  end
end

#kubernetes_namespace_admission_rules ⇒ ::Google::Protobuf::Map{::String => ::Google::Cloud::BinaryAuthorization::V1::AdmissionRule}

Returns Optional. Per-kubernetes-namespace admission rules. K8s namespace spec format: [a-z.-]+, e.g. 'some-namespace'.

Returns:



74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
 
# File 'proto_docs/google/cloud/binaryauthorization/v1/resources.rb', line 74

class Policy
  include ::Google::Protobuf::MessageExts
  extend ::Google::Protobuf::MessageExts::ClassMethods

  # @!attribute [rw] key
  #   @return [::String]
  # @!attribute [rw] value
  #   @return [::Google::Cloud::BinaryAuthorization::V1::AdmissionRule]
  class ClusterAdmissionRulesEntry
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # @!attribute [rw] key
  #   @return [::String]
  # @!attribute [rw] value
  #   @return [::Google::Cloud::BinaryAuthorization::V1::AdmissionRule]
  class KubernetesNamespaceAdmissionRulesEntry
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # @!attribute [rw] key
  #   @return [::String]
  # @!attribute [rw] value
  #   @return [::Google::Cloud::BinaryAuthorization::V1::AdmissionRule]
  class KubernetesServiceAccountAdmissionRulesEntry
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # @!attribute [rw] key
  #   @return [::String]
  # @!attribute [rw] value
  #   @return [::Google::Cloud::BinaryAuthorization::V1::AdmissionRule]
  class IstioServiceIdentityAdmissionRulesEntry
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  module GlobalPolicyEvaluationMode
    # Not specified: DISABLE is assumed.
    GLOBAL_POLICY_EVALUATION_MODE_UNSPECIFIED = 0

    # Enables system policy evaluation.
    ENABLE = 1

    # Disables system policy evaluation.
    DISABLE = 2
  end
end

#kubernetes_service_account_admission_rules ⇒ ::Google::Protobuf::Map{::String => ::Google::Cloud::BinaryAuthorization::V1::AdmissionRule}

Returns Optional. Per-kubernetes-service-account admission rules. Service account spec format: namespace:serviceaccount. e.g. 'test-ns:default'.

Returns:



74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
 
# File 'proto_docs/google/cloud/binaryauthorization/v1/resources.rb', line 74

class Policy
  include ::Google::Protobuf::MessageExts
  extend ::Google::Protobuf::MessageExts::ClassMethods

  # @!attribute [rw] key
  #   @return [::String]
  # @!attribute [rw] value
  #   @return [::Google::Cloud::BinaryAuthorization::V1::AdmissionRule]
  class ClusterAdmissionRulesEntry
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # @!attribute [rw] key
  #   @return [::String]
  # @!attribute [rw] value
  #   @return [::Google::Cloud::BinaryAuthorization::V1::AdmissionRule]
  class KubernetesNamespaceAdmissionRulesEntry
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # @!attribute [rw] key
  #   @return [::String]
  # @!attribute [rw] value
  #   @return [::Google::Cloud::BinaryAuthorization::V1::AdmissionRule]
  class KubernetesServiceAccountAdmissionRulesEntry
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # @!attribute [rw] key
  #   @return [::String]
  # @!attribute [rw] value
  #   @return [::Google::Cloud::BinaryAuthorization::V1::AdmissionRule]
  class IstioServiceIdentityAdmissionRulesEntry
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  module GlobalPolicyEvaluationMode
    # Not specified: DISABLE is assumed.
    GLOBAL_POLICY_EVALUATION_MODE_UNSPECIFIED = 0

    # Enables system policy evaluation.
    ENABLE = 1

    # Disables system policy evaluation.
    DISABLE = 2
  end
end

#name ⇒ ::String (readonly)

Returns Output only. The resource name, in the format projects/*/policy. There is at most one policy per project.

Returns:

  • (::String) —

    Output only. The resource name, in the format projects/*/policy. There is at most one policy per project.



74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
 
# File 'proto_docs/google/cloud/binaryauthorization/v1/resources.rb', line 74

class Policy
  include ::Google::Protobuf::MessageExts
  extend ::Google::Protobuf::MessageExts::ClassMethods

  # @!attribute [rw] key
  #   @return [::String]
  # @!attribute [rw] value
  #   @return [::Google::Cloud::BinaryAuthorization::V1::AdmissionRule]
  class ClusterAdmissionRulesEntry
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # @!attribute [rw] key
  #   @return [::String]
  # @!attribute [rw] value
  #   @return [::Google::Cloud::BinaryAuthorization::V1::AdmissionRule]
  class KubernetesNamespaceAdmissionRulesEntry
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # @!attribute [rw] key
  #   @return [::String]
  # @!attribute [rw] value
  #   @return [::Google::Cloud::BinaryAuthorization::V1::AdmissionRule]
  class KubernetesServiceAccountAdmissionRulesEntry
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # @!attribute [rw] key
  #   @return [::String]
  # @!attribute [rw] value
  #   @return [::Google::Cloud::BinaryAuthorization::V1::AdmissionRule]
  class IstioServiceIdentityAdmissionRulesEntry
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  module GlobalPolicyEvaluationMode
    # Not specified: DISABLE is assumed.
    GLOBAL_POLICY_EVALUATION_MODE_UNSPECIFIED = 0

    # Enables system policy evaluation.
    ENABLE = 1

    # Disables system policy evaluation.
    DISABLE = 2
  end
end

#update_time ⇒ ::Google::Protobuf::Timestamp (readonly)

Returns Output only. Time when the policy was last updated.

Returns:



74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
 
# File 'proto_docs/google/cloud/binaryauthorization/v1/resources.rb', line 74

class Policy
  include ::Google::Protobuf::MessageExts
  extend ::Google::Protobuf::MessageExts::ClassMethods

  # @!attribute [rw] key
  #   @return [::String]
  # @!attribute [rw] value
  #   @return [::Google::Cloud::BinaryAuthorization::V1::AdmissionRule]
  class ClusterAdmissionRulesEntry
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # @!attribute [rw] key
  #   @return [::String]
  # @!attribute [rw] value
  #   @return [::Google::Cloud::BinaryAuthorization::V1::AdmissionRule]
  class KubernetesNamespaceAdmissionRulesEntry
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # @!attribute [rw] key
  #   @return [::String]
  # @!attribute [rw] value
  #   @return [::Google::Cloud::BinaryAuthorization::V1::AdmissionRule]
  class KubernetesServiceAccountAdmissionRulesEntry
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # @!attribute [rw] key
  #   @return [::String]
  # @!attribute [rw] value
  #   @return [::Google::Cloud::BinaryAuthorization::V1::AdmissionRule]
  class IstioServiceIdentityAdmissionRulesEntry
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  module GlobalPolicyEvaluationMode
    # Not specified: DISABLE is assumed.
    GLOBAL_POLICY_EVALUATION_MODE_UNSPECIFIED = 0

    # Enables system policy evaluation.
    ENABLE = 1

    # Disables system policy evaluation.
    DISABLE = 2
  end
end