Struct AdmissionRule

#[non_exhaustive]
pub struct AdmissionRule {
    pub evaluation_mode: EvaluationMode,
    pub require_attestations_by: Vec<String>,
    pub enforcement_mode: EnforcementMode,
}

An admission rule specifies either that all container images used in a pod creation request must be attested to by one or more attestors, that all pod creations will be allowed, or that all pod creations will be denied.

Images matching an admission allowlist pattern are exempted from admission rules and will never block a pod creation.

Fields (Non-exhaustive)

Non-exhaustive structs could have additional fields added in future. Therefore, non-exhaustive structs cannot be constructed in external crates using the traditional Struct { .. } syntax; cannot be matched against without a wildcard ..; and struct update syntax will not work.

evaluation_mode: EvaluationMode

Required. How this admission rule will be evaluated.

require_attestations_by: Vec<String>

Optional. The resource names of the attestors that must attest to a container image, in the format projects/*/attestors/*. Each attestor must exist before a policy can reference it. To add an attestor to a policy the principal issuing the policy change request must be able to read the attestor resource.

Note: this field must be non-empty when the evaluation_mode field specifies REQUIRE_ATTESTATION, otherwise it must be empty.

enforcement_mode: EnforcementMode

Required. The action when a pod creation is denied by the admission rule.

Implementations

impl AdmissionRule

pub fn new() -> Self

pub fn set_evaluation_mode<T: Into<EvaluationMode>>(self, v: T) -> Self

Sets the value of evaluation_mode.

pub fn set_enforcement_mode<T: Into<EnforcementMode>>(self, v: T) -> Self

Sets the value of enforcement_mode.

pub fn set_require_attestations_by<T, V>(self, v: T) -> Self

where T: IntoIterator<Item = V>, V: Into<String>,

Sets the value of require_attestations_by.

Trait Implementations

impl Clone for AdmissionRule

fn clone(&self) -> AdmissionRule

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AdmissionRule

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for AdmissionRule

fn default() -> AdmissionRule

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for AdmissionRule

where AdmissionRule: Default,

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Message for AdmissionRule

fn typename() -> &'static str

The typename of this message.

fn to_map(&self) -> Result<Map<String, Value>, AnyError>

where Self: Sized + Serialize,

Store the value into a JSON object.

fn from_map(map: &Map<String, Value>) -> Result<Self, AnyError>

where Self: DeserializeOwned,

Extract the value from a JSON object.

impl PartialEq for AdmissionRule

fn eq(&self, other: &AdmissionRule) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for AdmissionRule

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for AdmissionRule