Class: Google::Cloud::BinaryAuthorization::V1beta1::AdmissionRule

Inherits:
Object
  • Object
show all
Extended by:
Protobuf::MessageExts::ClassMethods
Includes:
Protobuf::MessageExts
Defined in:
proto_docs/google/cloud/binaryauthorization/v1beta1/resources.rb

Overview

An admission rule specifies either that all container images used in a pod creation request must be attested to by one or more attestors, that all pod creations will be allowed, or that all pod creations will be denied.

Images matching an [admission allowlist pattern][google.cloud.binaryauthorization.v1beta1.AdmissionWhitelistPattern] are exempted from admission rules and will never block a pod creation.

Defined Under Namespace

Modules: EnforcementMode, EvaluationMode

Instance Attribute Summary collapse

Instance Attribute Details

#enforcement_mode ⇒ ::Google::Cloud::BinaryAuthorization::V1beta1::AdmissionRule::EnforcementMode

Returns Required. The action when a pod creation is denied by the admission rule.

Returns:



124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
 
# File 'proto_docs/google/cloud/binaryauthorization/v1beta1/resources.rb', line 124

class AdmissionRule
  include ::Google::Protobuf::MessageExts
  extend ::Google::Protobuf::MessageExts::ClassMethods

  module EvaluationMode
    # Do not use.
    EVALUATION_MODE_UNSPECIFIED = 0

    # This rule allows all all pod creations.
    ALWAYS_ALLOW = 1

    # This rule allows a pod creation if all the attestors listed in
    # 'require_attestations_by' have valid attestations for all of the
    # images in the pod spec.
    REQUIRE_ATTESTATION = 2

    # This rule denies all pod creations.
    ALWAYS_DENY = 3
  end

  # Defines the possible actions when a pod creation is denied by an admission
  # rule.
  module EnforcementMode
    # Do not use.
    ENFORCEMENT_MODE_UNSPECIFIED = 0

    # Enforce the admission rule by blocking the pod creation.
    ENFORCED_BLOCK_AND_AUDIT_LOG = 1

    # Dryrun mode: Audit logging only.  This will allow the pod creation as if
    # the admission request had specified break-glass.
    DRYRUN_AUDIT_LOG_ONLY = 2
  end
end

#evaluation_mode ⇒ ::Google::Cloud::BinaryAuthorization::V1beta1::AdmissionRule::EvaluationMode

Returns Required. How this admission rule will be evaluated.

Returns:



124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
 
# File 'proto_docs/google/cloud/binaryauthorization/v1beta1/resources.rb', line 124

class AdmissionRule
  include ::Google::Protobuf::MessageExts
  extend ::Google::Protobuf::MessageExts::ClassMethods

  module EvaluationMode
    # Do not use.
    EVALUATION_MODE_UNSPECIFIED = 0

    # This rule allows all all pod creations.
    ALWAYS_ALLOW = 1

    # This rule allows a pod creation if all the attestors listed in
    # 'require_attestations_by' have valid attestations for all of the
    # images in the pod spec.
    REQUIRE_ATTESTATION = 2

    # This rule denies all pod creations.
    ALWAYS_DENY = 3
  end

  # Defines the possible actions when a pod creation is denied by an admission
  # rule.
  module EnforcementMode
    # Do not use.
    ENFORCEMENT_MODE_UNSPECIFIED = 0

    # Enforce the admission rule by blocking the pod creation.
    ENFORCED_BLOCK_AND_AUDIT_LOG = 1

    # Dryrun mode: Audit logging only.  This will allow the pod creation as if
    # the admission request had specified break-glass.
    DRYRUN_AUDIT_LOG_ONLY = 2
  end
end

#require_attestations_by ⇒ ::Array<::String>

Returns Optional. The resource names of the attestors that must attest to a container image, in the format projects/*/attestors/*. Each attestor must exist before a policy can reference it. To add an attestor to a policy the principal issuing the policy change request must be able to read the attestor resource.

Note: this field must be non-empty when the evaluation_mode field specifies REQUIRE_ATTESTATION, otherwise it must be empty.

Returns:

  • (::Array<::String>) —

    Optional. The resource names of the attestors that must attest to a container image, in the format projects/*/attestors/*. Each attestor must exist before a policy can reference it. To add an attestor to a policy the principal issuing the policy change request must be able to read the attestor resource.

    Note: this field must be non-empty when the evaluation_mode field specifies REQUIRE_ATTESTATION, otherwise it must be empty.



124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
 
# File 'proto_docs/google/cloud/binaryauthorization/v1beta1/resources.rb', line 124

class AdmissionRule
  include ::Google::Protobuf::MessageExts
  extend ::Google::Protobuf::MessageExts::ClassMethods

  module EvaluationMode
    # Do not use.
    EVALUATION_MODE_UNSPECIFIED = 0

    # This rule allows all all pod creations.
    ALWAYS_ALLOW = 1

    # This rule allows a pod creation if all the attestors listed in
    # 'require_attestations_by' have valid attestations for all of the
    # images in the pod spec.
    REQUIRE_ATTESTATION = 2

    # This rule denies all pod creations.
    ALWAYS_DENY = 3
  end

  # Defines the possible actions when a pod creation is denied by an admission
  # rule.
  module EnforcementMode
    # Do not use.
    ENFORCEMENT_MODE_UNSPECIFIED = 0

    # Enforce the admission rule by blocking the pod creation.
    ENFORCED_BLOCK_AND_AUDIT_LOG = 1

    # Dryrun mode: Audit logging only.  This will allow the pod creation as if
    # the admission request had specified break-glass.
    DRYRUN_AUDIT_LOG_ONLY = 2
  end
end