Struct Policy 

#[non_exhaustive]
pub struct Policy {
    pub name: String,
    pub description: String,
    pub global_policy_evaluation_mode: GlobalPolicyEvaluationMode,
    pub admission_whitelist_patterns: Vec<AdmissionWhitelistPattern>,
    pub cluster_admission_rules: HashMap<String, AdmissionRule>,
    pub kubernetes_namespace_admission_rules: HashMap<String, AdmissionRule>,
    pub kubernetes_service_account_admission_rules: HashMap<String, AdmissionRule>,
    pub istio_service_identity_admission_rules: HashMap<String, AdmissionRule>,
    pub default_admission_rule: Option<AdmissionRule>,
    pub update_time: Option<Timestamp>,
    /* private fields */
}

A policy for container image binary authorization.

Fields (Non-exhaustive)

Non-exhaustive structs could have additional fields added in future. Therefore, non-exhaustive structs cannot be constructed in external crates using the traditional Struct { .. } syntax; cannot be matched against without a wildcard ..; and struct update syntax will not work.

name: String

Output only. The resource name, in the format projects/*/policy. There is at most one policy per project.

description: String

Optional. A descriptive comment.

global_policy_evaluation_mode: GlobalPolicyEvaluationMode

Optional. Controls the evaluation of a Google-maintained global admission policy for common system-level images. Images not covered by the global policy will be subject to the project admission policy. This setting has no effect when specified inside a global admission policy.

admission_whitelist_patterns: Vec<AdmissionWhitelistPattern>

Optional. Admission policy allowlisting. A matching admission request will always be permitted. This feature is typically used to exclude Google or third-party infrastructure images from Binary Authorization policies.

cluster_admission_rules: HashMap<String, AdmissionRule>

Optional. Per-cluster admission rules. Cluster spec format: location.clusterId. There can be at most one admission rule per cluster spec. A location is either a compute zone (e.g. us-central1-a) or a region (e.g. us-central1). For clusterId syntax restrictions see https://cloud.google.com/container-engine/reference/rest/v1/projects.zones.clusters.

kubernetes_namespace_admission_rules: HashMap<String, AdmissionRule>

Optional. Per-kubernetes-namespace admission rules. K8s namespace spec format: [a-z.-]+, e.g. ‘some-namespace’

kubernetes_service_account_admission_rules: HashMap<String, AdmissionRule>

Optional. Per-kubernetes-service-account admission rules. Service account spec format: namespace:serviceaccount. e.g. ‘test-ns:default’

istio_service_identity_admission_rules: HashMap<String, AdmissionRule>

Optional. Per-istio-service-identity admission rules. Istio service identity spec format: spiffe://<domain>/ns/<namespace>/sa/<serviceaccount> or <domain>/ns/<namespace>/sa/<serviceaccount> e.g. spiffe://example.com/ns/test-ns/sa/default

default_admission_rule: Option<AdmissionRule>

Required. Default admission rule for a cluster without a per-cluster, per- kubernetes-service-account, or per-istio-service-identity admission rule.

update_time: Option<Timestamp>

Output only. Time when the policy was last updated.

Implementations

impl Policy

pub fn new() -> Self

pub fn set_name<T: Into<String>>(self, v: T) -> Self

Sets the value of name.

pub fn set_description<T: Into<String>>(self, v: T) -> Self

Sets the value of description.

pub fn set_global_policy_evaluation_mode<T: Into<GlobalPolicyEvaluationMode>>( self, v: T, ) -> Self

Sets the value of global_policy_evaluation_mode.

pub fn set_admission_whitelist_patterns<T, V>(self, v: T) -> Self

where T: IntoIterator<Item = V>, V: Into<AdmissionWhitelistPattern>,

Sets the value of admission_whitelist_patterns.

pub fn set_cluster_admission_rules<T, K, V>(self, v: T) -> Self

where T: IntoIterator<Item = (K, V)>, K: Into<String>, V: Into<AdmissionRule>,

Sets the value of cluster_admission_rules.

pub fn set_kubernetes_namespace_admission_rules<T, K, V>(self, v: T) -> Self

where T: IntoIterator<Item = (K, V)>, K: Into<String>, V: Into<AdmissionRule>,

Sets the value of kubernetes_namespace_admission_rules.

pub fn set_kubernetes_service_account_admission_rules<T, K, V>( self, v: T, ) -> Self

where T: IntoIterator<Item = (K, V)>, K: Into<String>, V: Into<AdmissionRule>,

Sets the value of kubernetes_service_account_admission_rules.

pub fn set_istio_service_identity_admission_rules<T, K, V>(self, v: T) -> Self

where T: IntoIterator<Item = (K, V)>, K: Into<String>, V: Into<AdmissionRule>,

Sets the value of istio_service_identity_admission_rules.

pub fn set_default_admission_rule<T>(self, v: T) -> Self

where T: Into<AdmissionRule>,

Sets the value of default_admission_rule.

pub fn set_or_clear_default_admission_rule<T>(self, v: Option<T>) -> Self

where T: Into<AdmissionRule>,

Sets or clears the value of default_admission_rule.

pub fn set_update_time<T>(self, v: T) -> Self

where T: Into<Timestamp>,

Sets the value of update_time.

pub fn set_or_clear_update_time<T>(self, v: Option<T>) -> Self

where T: Into<Timestamp>,

Sets or clears the value of update_time.

Trait Implementations

impl Clone for Policy

fn clone(&self) -> Policy

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Policy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for Policy

fn default() -> Policy

Returns the “default value” for a type.

impl Message for Policy

fn typename() -> &'static str

The typename of this message.

impl PartialEq for Policy

fn eq(&self, other: &Policy) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl StructuralPartialEq for Policy