Struct google_binaryauthorization1_beta1::api::Policy

pub struct Policy {
    pub admission_whitelist_patterns: Option<Vec<AdmissionWhitelistPattern>>,
    pub cluster_admission_rules: Option<HashMap<String, AdmissionRule>>,
    pub default_admission_rule: Option<AdmissionRule>,
    pub description: Option<String>,
    pub global_policy_evaluation_mode: Option<String>,
    pub istio_service_identity_admission_rules: Option<HashMap<String, AdmissionRule>>,
    pub kubernetes_namespace_admission_rules: Option<HashMap<String, AdmissionRule>>,
    pub kubernetes_service_account_admission_rules: Option<HashMap<String, AdmissionRule>>,
    pub name: Option<String>,
    pub update_time: Option<String>,
}

A policy for container image binary authorization.

Activities

This type is used in activities, which are methods you may call on this type or where this type is involved in. The list links the activity name, along with information about where it is used (one of request and response).

• get policy projects (response)
• update policy projects (request|response)
• get policy systempolicy (response)

Fields

admission_whitelist_patterns: Option<Vec<AdmissionWhitelistPattern>>

Optional. Admission policy allowlisting. A matching admission request will always be permitted. This feature is typically used to exclude Google or third-party infrastructure images from Binary Authorization policies.

cluster_admission_rules: Option<HashMap<String, AdmissionRule>>

Optional. Per-cluster admission rules. Cluster spec format: location.clusterId. There can be at most one admission rule per cluster spec. A location is either a compute zone (e.g. us-central1-a) or a region (e.g. us-central1). For clusterId syntax restrictions see https://cloud.google.com/container-engine/reference/rest/v1/projects.zones.clusters.

default_admission_rule: Option<AdmissionRule>

Required. Default admission rule for a cluster without a per-cluster, per- kubernetes-service-account, or per-istio-service-identity admission rule.

description: Option<String>

Optional. A descriptive comment.

global_policy_evaluation_mode: Option<String>

Optional. Controls the evaluation of a Google-maintained global admission policy for common system-level images. Images not covered by the global policy will be subject to the project admission policy. This setting has no effect when specified inside a global admission policy.

istio_service_identity_admission_rules: Option<HashMap<String, AdmissionRule>>

Optional. Per-istio-service-identity admission rules. Istio service identity spec format: spiffe:///ns//sa/ or /ns//sa/ e.g. spiffe://example.com/ns/test-ns/sa/default

kubernetes_namespace_admission_rules: Option<HashMap<String, AdmissionRule>>

Optional. Per-kubernetes-namespace admission rules. K8s namespace spec format: [a-z.-]+, e.g. ‘some-namespace’

kubernetes_service_account_admission_rules: Option<HashMap<String, AdmissionRule>>

Optional. Per-kubernetes-service-account admission rules. Service account spec format: namespace:serviceaccount. e.g. ‘test-ns:default’

name: Option<String>

Output only. The resource name, in the format projects/*/policy. There is at most one policy per project.

update_time: Option<String>

Output only. Time when the policy was last updated.

Trait Implementations

impl Clone for Policy

fn clone(&self) -> Policy

Returns a copy of the value.

pub fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Policy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for Policy

fn default() -> Policy

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for Policy

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error> where
    __D: Deserializer<'de>, 

Deserialize this value from the given Serde deserializer.

impl RequestValue for Policy

impl ResponseResult for Policy

impl Serialize for Policy

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error> where
    __S: Serializer, 

Serialize this value into the given Serde serializer.