Struct google_binaryauthorization1_beta1::api::Policy
source · pub struct Policy {
pub admission_whitelist_patterns: Option<Vec<AdmissionWhitelistPattern>>,
pub cluster_admission_rules: Option<HashMap<String, AdmissionRule>>,
pub default_admission_rule: Option<AdmissionRule>,
pub description: Option<String>,
pub etag: Option<String>,
pub global_policy_evaluation_mode: Option<String>,
pub istio_service_identity_admission_rules: Option<HashMap<String, AdmissionRule>>,
pub kubernetes_namespace_admission_rules: Option<HashMap<String, AdmissionRule>>,
pub kubernetes_service_account_admission_rules: Option<HashMap<String, AdmissionRule>>,
pub name: Option<String>,
pub update_time: Option<DateTime<Utc>>,
}
Expand description
A policy for Binary Authorization.
Activities
This type is used in activities, which are methods you may call on this type or where this type is involved in. The list links the activity name, along with information about where it is used (one of request and response).
- get policy projects (response)
- update policy projects (request|response)
- get policy systempolicy (response)
Fields§
§admission_whitelist_patterns: Option<Vec<AdmissionWhitelistPattern>>
Optional. Admission policy allowlisting. A matching admission request will always be permitted. This feature is typically used to exclude Google or third-party infrastructure images from Binary Authorization policies.
cluster_admission_rules: Option<HashMap<String, AdmissionRule>>
Optional. Per-cluster admission rules. Cluster spec format: location.clusterId
. There can be at most one admission rule per cluster spec. A location
is either a compute zone (e.g. us-central1-a) or a region (e.g. us-central1). For clusterId
syntax restrictions see https://cloud.google.com/container-engine/reference/rest/v1/projects.zones.clusters.
default_admission_rule: Option<AdmissionRule>
Required. Default admission rule for a cluster without a per-cluster, per- kubernetes-service-account, or per-istio-service-identity admission rule.
description: Option<String>
Optional. A descriptive comment.
etag: Option<String>
Optional. A checksum, returned by the server, that can be sent on update requests to ensure the policy has an up-to-date value before attempting to update it. See https://google.aip.dev/154.
global_policy_evaluation_mode: Option<String>
Optional. Controls the evaluation of a Google-maintained global admission policy for common system-level images. Images not covered by the global policy will be subject to the project admission policy. This setting has no effect when specified inside a global admission policy.
istio_service_identity_admission_rules: Option<HashMap<String, AdmissionRule>>
Optional. Per-istio-service-identity admission rules. Istio service identity spec format: spiffe:///ns//sa/
or /ns//sa/
e.g. spiffe://example.com/ns/test-ns/sa/default
kubernetes_namespace_admission_rules: Option<HashMap<String, AdmissionRule>>
Optional. Per-kubernetes-namespace admission rules. K8s namespace spec format: [a-z.-]+
, e.g. some-namespace
kubernetes_service_account_admission_rules: Option<HashMap<String, AdmissionRule>>
Optional. Per-kubernetes-service-account admission rules. Service account spec format: namespace:serviceaccount
. e.g. test-ns:default
name: Option<String>
Output only. The resource name, in the format projects/*/policy
. There is at most one policy per project.
update_time: Option<DateTime<Utc>>
Output only. Time when the policy was last updated.