Index
BinauthzManagementServiceV1
(interface)PlatformPolicyEvaluationService
(interface)PlatformPolicyManagementService
(interface)SystemPolicyV1
(interface)ValidationHelperV1
(interface)AdmissionRule
(message)AdmissionRule.EnforcementMode
(enum)AdmissionRule.EvaluationMode
(enum)AdmissionWhitelistPattern
(message)AllowlistResult
(message)AttestationAuthenticator
(message)Attestor
(message)AttestorPublicKey
(message)Check
(message)CheckResult
(message)CheckResult.EvaluationResult
(message)CheckResult.EvaluationResult.CheckVerdict
(enum)CheckSet
(message)CheckSetResult
(message)CheckSetResult.CheckResults
(message)CreateAttestorRequest
(message)CreatePlatformPolicyRequest
(message)DeleteAttestorRequest
(message)DeletePlatformPolicyRequest
(message)EvaluateGkePolicyRequest
(message)EvaluateGkePolicyResponse
(message)EvaluateGkePolicyResponse.Verdict
(enum)GetAttestorRequest
(message)GetPlatformPolicyRequest
(message)GetPolicyRequest
(message)GetSystemPolicyRequest
(message)GkePolicy
(message)ImageAllowlist
(message)ImageFreshnessCheck
(message)ImageResult
(message)ImageResult.ImageVerdict
(enum)ListAttestorsRequest
(message)ListAttestorsResponse
(message)ListPlatformPoliciesRequest
(message)ListPlatformPoliciesResponse
(message)PkixPublicKey
(message)PkixPublicKey.SignatureAlgorithm
(enum)PkixPublicKeySet
(message)PlatformPolicy
(message)PodResult
(message)PodResult.PodVerdict
(enum)Policy
(message)Policy.GlobalPolicyEvaluationMode
(enum)ReplacePlatformPolicyRequest
(message)Scope
(message)SigstoreAuthority
(message)SigstorePublicKey
(message)SigstorePublicKeySet
(message)SigstoreSignatureCheck
(message)SimpleSigningAttestationCheck
(message)SlsaCheck
(message)SlsaCheck.AttestationSource
(message)SlsaCheck.TrustedBuilder
(enum)SlsaCheck.VerificationRule
(message)TrustedDirectoryCheck
(message)UpdateAttestorRequest
(message)UpdatePolicyRequest
(message)UserOwnedGrafeasNote
(message)ValidateAttestationOccurrenceRequest
(message)ValidateAttestationOccurrenceResponse
(message)ValidateAttestationOccurrenceResponse.Result
(enum)VulnerabilityCheck
(message)VulnerabilityCheck.MaximumAllowedSeverity
(enum)
BinauthzManagementServiceV1
Google Cloud Management Service for Binary Authorization admission policies and attestation authorities.
This API implements a REST model with the following objects:
CreateAttestor |
---|
Creates an
|
DeleteAttestor |
---|
Deletes an
|
GetAttestor |
---|
Gets an
|
GetPolicy |
---|
A Gets the
|
ListAttestors |
---|
Lists
|
UpdateAttestor |
---|
Updates an
|
UpdatePolicy |
---|
Creates or updates a project's
|
PlatformPolicyEvaluationService
Google Cloud Service for evaluating platform policies.
This API implements a REST model with PlatformPolicy
objects.
EvaluateGkePolicy |
---|
Evaluates a Kubernetes object versus a GKE
|
PlatformPolicyManagementService
Google Cloud Management Service for platform policies.
This API implements a REST model with PlatformPolicy
objects.
CreatePlatformPolicy |
---|
Creates a
|
DeletePlatformPolicy |
---|
Deletes a
|
GetPlatformPolicy |
---|
Gets a
|
ListPlatformPolicies |
---|
Lists
|
ReplacePlatformPolicy |
---|
Replaces a
|
SystemPolicyV1
API for working with the system policy.
GetSystemPolicy |
---|
Gets the current system policy in the specified location.
|
ValidationHelperV1
BinAuthz Attestor verification
ValidateAttestationOccurrence |
---|
Returns whether the given
|
AdmissionRule
An admission rule
specifies either that all container images used in a pod creation request must be attested to by one or more attestors
, that all pod creations will be allowed, or that all pod creations will be denied.
Images matching an admission allowlist pattern
are exempted from admission rules and will never block a pod creation.
Fields | |
---|---|
evaluation_mode |
Required. How this admission rule will be evaluated. |
require_attestations_by[] |
Optional. The resource names of the attestors that must attest to a container image, in the format Note: this field must be non-empty when the |
enforcement_mode |
Required. The action when a pod creation is denied by the admission rule. |
EnforcementMode
Defines the possible actions when a pod creation is denied by an admission rule.
Enums | |
---|---|
ENFORCEMENT_MODE_UNSPECIFIED |
Do not use. |
ENFORCED_BLOCK_AND_AUDIT_LOG |
Enforce the admission rule by blocking the pod creation. |
DRYRUN_AUDIT_LOG_ONLY |
Dryrun mode: Audit logging only. This will allow the pod creation as if the admission request had specified break-glass. |
EvaluationMode
Enums | |
---|---|
EVALUATION_MODE_UNSPECIFIED |
Do not use. |
ALWAYS_ALLOW |
This rule allows all pod creations. |
REQUIRE_ATTESTATION |
This rule allows a pod creation if all the attestors listed in require_attestations_by have valid attestations for all of the images in the pod spec. |
ALWAYS_DENY |
This rule denies all pod creations. |
AdmissionWhitelistPattern
An admission allowlist pattern
exempts images from checks by admission rules
.
Fields | |
---|---|
name_pattern |
An image name pattern to allowlist, in the form |
AllowlistResult
Result of evaluating an image name allowlist.
Fields | |
---|---|
matched_pattern |
The allowlist pattern that the image matched. |
AttestationAuthenticator
An attestation authenticator
that will be used to verify attestations. Typically this is just a set of public keys.
Conceptually, an authenticator can be treated as always returning either "authenticated" or "not authenticated" when presented with a signed attestation (almost always assumed to be a DSSE attestation). The details of how an authenticator makes this decision are specific to the type of 'authenticator' that this message wraps.
Fields | |
---|---|
display_name |
Optional. A user-provided name for this |
Union field authenticator . The specific type of authentication configured by this authenticator. authenticator can be only one of the following: |
|
pkix_public_key_set |
Optional. A set of raw PKIX SubjectPublicKeyInfo format public keys. If any public key in the set validates the attestation signature, then the signature is considered authenticated (i.e. any one key is sufficient to authenticate). |
Attestor
An attestor
that attests to container image artifacts. An existing attestor cannot be modified except where indicated.
Fields | |
---|---|
name |
Required. The resource name, in the format: |
description |
Optional. A descriptive comment. This field may be updated. The field may be displayed in chooser dialogs. |
update_time |
Output only. Time when the attestor was last updated. |
etag |
Optional. A checksum, returned by the server, that can be sent on update requests to ensure the attestor has an up-to-date value before attempting to update it. See https://google.aip.dev/154. |
Union field
|
|
user_owned_grafeas_note |
This specifies how an attestation will be read, and how it will be used during policy enforcement. |
AttestorPublicKey
An attestor public key
that will be used to verify attestations signed by this attestor.
Fields | |
---|---|
comment |
Optional. A descriptive comment. This field may be updated. |
id |
The ID of this public key. Signatures verified by Binary Authorization must include the ID of the public key that can be used to verify them, and that ID must match the contents of this field exactly. Additional restrictions on this field can be imposed based on which public key type is encapsulated. See the documentation on |
Union field
|
|
ascii_armored_pgp_public_key |
ASCII-armored representation of a PGP public key, as the entire output by the command |
pkix_public_key |
A raw PKIX SubjectPublicKeyInfo format public key. NOTE: |
Check
A single check to perform against a Pod. Checks are grouped into CheckSet
objects, which are defined by the top-level policy.
Fields | |
---|---|
display_name |
Optional. A user-provided name for this check. This field has no effect on the policy evaluation behavior except to improve readability of messages in evaluation results. |
image_allowlist |
Optional. Images exempted from this check. If any of the patterns match the image url, the check will not be evaluated. |
Union field check . The specific type and configuration of check to perform. check can be only one of the following: |
|
always_deny |
Optional. A special-case check that always denies. Note that this still only applies when the scope of the This check is primarily useful for testing, or to set the default behavior for all unmatched scopes to "deny". |
simple_signing_attestation_check |
Optional. Require a SimpleSigning-type attestation for every image in the deployment. |
trusted_directory_check |
Optional. Require that an image lives in a trusted directory. |
image_freshness_check |
Optional. Require that an image is no older than a configured expiration time. Image age is determined by its upload time. |
vulnerability_check |
Optional. Require that an image does not contain vulnerabilities that violate the configured rules, such as based on severity levels. |
slsa_check |
Optional. Require that an image was built by a trusted builder (such as Google Cloud Build), meets requirements for Supply chain Levels for Software Artifacts (SLSA), and was built from a trusted source code repostitory. |
sigstore_signature_check |
Optional. Require that an image was signed by Cosign with a trusted key. This check requires that both the image and signature are stored in Artifact Registry. |
CheckResult
Result of evaluating one check.
Fields | |
---|---|
index |
The index of the check. |
display_name |
The name of the check. |
type |
The type of the check. |
explanation |
Explanation of this check result. |
Union field result . How the check was evaluated. result can be only one of the following: |
|
allowlist_result |
If the image was exempted by an |
evaluation_result |
If a check was evaluated, contains the result of the check. |
EvaluationResult
Result of evaluating one check.
Fields | |
---|---|
verdict |
The result of evaluating this check. |
CheckVerdict
Whether the check passed, failed, or couldn't be evaluated.
Enums | |
---|---|
CHECK_VERDICT_UNSPECIFIED |
Not specified. This should never be used. |
CONFORMANT |
The check was successfully evaluated and the image satisfied the check. |
NON_CONFORMANT |
The check was successfully evaluated and the image did not satisfy the check. |
ERROR |
The check was not successfully evaluated. |
CheckSet
A conjunction of policy checks, scoped to a particular namespace or Kubernetes service account.
In order for evaluation of a CheckSet
to return "allowed" for a given image in a given Pod, one of the following conditions must be satisfied:
- The image is explicitly exempted by an entry in
image_allowlist
, OR - ALL of the
checks
evaluate to "allowed".
Fields | |
---|---|
display_name |
Optional. A user-provided name for this |
scope |
Optional. The scope to which this |
image_allowlist |
Optional. Images exempted from this |
checks[] |
Optional. The checks to apply. The ultimate result of evaluating the check set will be "allow" if and only if every check in If |
CheckSetResult
Result of evaluating one check set.
Fields | |
---|---|
index |
The index of the check set. |
display_name |
The name of the check set. |
scope |
The scope of the check set. |
explanation |
Explanation of this check set result. Only populated if no checks were evaluated. |
Union field result . How the check set was evaluated. result can be only one of the following: |
|
allowlist_result |
If the image was exempted by an |
check_results |
If checks were evaluated, contains the results of evaluating each check. |
CheckResults
Result of evaluating one or more checks.
Fields | |
---|---|
results[] |
Per-check details. |
CreateAttestorRequest
Request message for BinauthzManagementServiceV1.CreateAttestor
.
Fields | |
---|---|
parent |
Required. The parent of this Authorization requires the following IAM permission on the specified resource
|
attestor_id |
Required. The |
attestor |
Required. The initial |
CreatePlatformPolicyRequest
Request message for PlatformPolicyManagementService.CreatePlatformPolicy
.
Fields | |
---|---|
parent |
Required. The parent of this Authorization requires the following IAM permission on the specified resource
|
policy_id |
Required. The |
policy |
Required. The initial |
DeleteAttestorRequest
Request message for BinauthzManagementServiceV1.DeleteAttestor
.
Fields | |
---|---|
name |
Required. The name of the Authorization requires the following IAM permission on the specified resource
|
DeletePlatformPolicyRequest
Request message for PlatformPolicyManagementService.DeletePlatformPolicy
.
Fields | |
---|---|
name |
Required. The name of the Authorization requires the following IAM permission on the specified resource
|
etag |
Optional. Used to prevent deleting the policy when another request has updated it since it was retrieved. |
EvaluateGkePolicyRequest
Request message for PlatformPolicyEvaluationService.EvaluateGkePolicy
.
Fields | |
---|---|
name |
Required. The name of the Authorization requires the following IAM permission on the specified resource
|
resource |
Required. JSON or YAML blob representing a Kubernetes resource. |
EvaluateGkePolicyResponse
Response message for PlatformPolicyEvaluationService.EvaluateGkePolicy
.
Fields | |
---|---|
verdict |
The result of evaluating all Pods in the request. |
results[] |
Evaluation result for each Pod contained in the request. |
Verdict
Whether the Pods passed, failed, or couldn't be evaluated.
Enums | |
---|---|
VERDICT_UNSPECIFIED |
Not specified. This should never be used. |
CONFORMANT |
All Pods in the request conform to the policy. |
NON_CONFORMANT |
At least one Pod does not conform to the policy. |
ERROR |
Encountered at least one error evaluating a Pod and all other Pods conform to the policy. Non-conformance has precedence over errors. |
GetAttestorRequest
Request message for BinauthzManagementServiceV1.GetAttestor
.
Fields | |
---|---|
name |
Required. The name of the Authorization requires the following IAM permission on the specified resource
|
GetPlatformPolicyRequest
Request message for PlatformPolicyManagementService.GetPlatformPolicy
.
Fields | |
---|---|
name |
Required. The name of the Authorization requires the following IAM permission on the specified resource
|
etag |
Optional. Used to prevent retrieving the policy when it has not changed since it was last retrieved. |
GetPolicyRequest
Request message for BinauthzManagementServiceV1.GetPolicy
.
Fields | |
---|---|
name |
Required. The resource name of the Authorization requires the following IAM permission on the specified resource
|
GetSystemPolicyRequest
Request to read the current system policy.
Fields | |
---|---|
name |
Required. The resource name, in the format |
GkePolicy
A Binary Authorization policy for a GKE cluster. This is one type of policy that can occur as a PlatformPolicy
.
Fields | |
---|---|
image_allowlist |
Optional. Images exempted from this policy. If any of the patterns match the image being evaluated, the rest of the policy will not be evaluated. |
check_sets[] |
Optional. The
If If |
ImageAllowlist
Images that are exempted from normal checks based on name pattern only.
Fields | |
---|---|
allow_pattern[] |
Required. A disjunction of image patterns to allow. If any of these patterns match, then the image is considered exempted by this allowlist. |
ImageFreshnessCheck
An image freshness check, which rejects images that were uploaded before the set number of days ago to the supported repositories.
Fields | |
---|---|
max_upload_age_days |
Required. The max number of days that is allowed since the image was uploaded. Must be greater than zero. |
ImageResult
Result of evaluating one image.
Fields | |
---|---|
image_uri |
Image URI from the request. |
verdict |
The result of evaluating this image. |
explanation |
Explanation of this image result. Only populated if no check sets were evaluated. |
Union field result . How the image was evaluated. result can be only one of the following: |
|
allowlist_result |
If the image was exempted by a top-level |
check_set_result |
If a check set was evaluated, contains the result of the check set. Empty if there were no check sets. |
ImageVerdict
Whether the image passed, failed, or couldn't be evaluated.
Enums | |
---|---|
IMAGE_VERDICT_UNSPECIFIED |
Not specified. This should never be used. |
CONFORMANT |
Image conforms to the policy. |
NON_CONFORMANT |
Image does not conform to the policy. |
ERROR |
Error evaluating the image. Non-conformance has precedence over errors. |
ListAttestorsRequest
Request message for BinauthzManagementServiceV1.ListAttestors
.
Fields | |
---|---|
parent |
Required. The resource name of the project associated with the Authorization requires the following IAM permission on the specified resource
|
page_size |
Requested page size. The server may return fewer results than requested. If unspecified, the server will pick an appropriate default. |
page_token |
A token identifying a page of results the server should return. Typically, this is the value of |
ListAttestorsResponse
Response message for BinauthzManagementServiceV1.ListAttestors
.
Fields | |
---|---|
attestors[] |
The list of |
next_page_token |
A token to retrieve the next page of results. Pass this value in the |
ListPlatformPoliciesRequest
Request message for PlatformPolicyManagementService.ListPlatformPolicies
.
Fields | |
---|---|
parent |
Required. The resource name of the platform associated with the Authorization requires the following IAM permission on the specified resource
|
page_size |
Requested page size. The server may return fewer results than requested. If unspecified, the server picks an appropriate default. |
page_token |
A token identifying a page of results the server should return. Typically, this is the value of |
ListPlatformPoliciesResponse
Response message for PlatformPolicyManagementService.ListPlatformPolicies
.
Fields | |
---|---|
platform_policies[] |
The list of |
next_page_token |
A token to retrieve the next page of results. Pass this value in the |
PkixPublicKey
A public key in the PkixPublicKey format. Public keys of this type are typically textually encoded using the PEM format.
Fields | |
---|---|
public_key_pem |
A PEM-encoded public key, as described in https://tools.ietf.org/html/rfc7468#section-13 |
signature_algorithm |
The signature algorithm used to verify a message against a signature using this key. These signature algorithm must match the structure and any object identifiers encoded in |
key_id |
Optional. The ID of this public key. Signatures verified by Binary Authorization must include the ID of the public key that can be used to verify them. The ID must match exactly contents of the The ID may be explicitly provided by the caller, but it MUST be a valid RFC3986 URI. If If this |
SignatureAlgorithm
Represents a signature algorithm and other information necessary to verify signatures with a given public key. This is based primarily on the public key types supported by Tink's PemKeyType, which is in turn based on KMS's supported signing algorithms. In the future, Binary Authorization might support additional public key types independently of Tink and/or KMS.
Enums | |
---|---|
SIGNATURE_ALGORITHM_UNSPECIFIED |
Not specified. |
RSA_PSS_2048_SHA256 |
RSASSA-PSS 2048 bit key with a SHA256 digest. |
RSA_SIGN_PSS_2048_SHA256 |
RSASSA-PSS 2048 bit key with a SHA256 digest. |
RSA_PSS_3072_SHA256 |
RSASSA-PSS 3072 bit key with a SHA256 digest. |
RSA_SIGN_PSS_3072_SHA256 |
RSASSA-PSS 3072 bit key with a SHA256 digest. |
RSA_PSS_4096_SHA256 |
RSASSA-PSS 4096 bit key with a SHA256 digest. |
RSA_SIGN_PSS_4096_SHA256 |
RSASSA-PSS 4096 bit key with a SHA256 digest. |
RSA_PSS_4096_SHA512 |
RSASSA-PSS 4096 bit key with a SHA512 digest. |
RSA_SIGN_PSS_4096_SHA512 |
RSASSA-PSS 4096 bit key with a SHA512 digest. |
RSA_SIGN_PKCS1_2048_SHA256 |
RSASSA-PKCS1-v1_5 with a 2048 bit key and a SHA256 digest. |
RSA_SIGN_PKCS1_3072_SHA256 |
RSASSA-PKCS1-v1_5 with a 3072 bit key and a SHA256 digest. |
RSA_SIGN_PKCS1_4096_SHA256 |
RSASSA-PKCS1-v1_5 with a 4096 bit key and a SHA256 digest. |
RSA_SIGN_PKCS1_4096_SHA512 |
RSASSA-PKCS1-v1_5 with a 4096 bit key and a SHA512 digest. |
ECDSA_P256_SHA256 |
ECDSA on the NIST P-256 curve with a SHA256 digest. |
EC_SIGN_P256_SHA256 |
ECDSA on the NIST P-256 curve with a SHA256 digest. |
ECDSA_P384_SHA384 |
ECDSA on the NIST P-384 curve with a SHA384 digest. |
EC_SIGN_P384_SHA384 |
ECDSA on the NIST P-384 curve with a SHA384 digest. |
ECDSA_P521_SHA512 |
ECDSA on the NIST P-521 curve with a SHA512 digest. |
EC_SIGN_P521_SHA512 |
ECDSA on the NIST P-521 curve with a SHA512 digest. |
PkixPublicKeySet
A bundle of PKIX public keys, used to authenticate attestation signatures.
Generally, a signature is considered to be authenticated by a PkixPublicKeySet
if any of the public keys verify it (i.e. it is an "OR" of the keys).
Fields | |
---|---|
pkix_public_keys[] |
Required. |
PlatformPolicy
A Binary Authorization platform policy
for deployments on various platforms
.
Fields | |
---|---|
name |
Output only. The relative resource name of the Binary Authorization platform policy, in the form of |
description |
Optional. A description comment about the policy. |
update_time |
Output only. Time when the policy was last updated. |
etag |
Optional. Used to prevent updating the policy when another request has updated it since it was retrieved. |
Union field policy_details . Platform-specific policy details. The detail should be consistent with the platform value in the URL. policy_details can be only one of the following: |
|
gke_policy |
Optional. GKE platform-specific policy. |
PodResult
Result of evaluating the whole GKE policy for one Pod.
Fields | |
---|---|
pod_name |
The name of the Pod. |
kubernetes_namespace |
The Kubernetes namespace of the Pod. |
kubernetes_service_account |
The Kubernetes service account of the Pod. |
verdict |
The result of evaluating this Pod. |
image_results[] |
Per-image details. |
PodVerdict
Whether the Pod passed, failed, or couldn't be evaluated.
Enums | |
---|---|
POD_VERDICT_UNSPECIFIED |
Not specified. This should never be used. |
CONFORMANT |
All images conform to the policy. |
NON_CONFORMANT |
At least one image does not conform to the policy. |
ERROR |
Encountered at least one error evaluating an image and all other images with non-error verdicts conform to the policy. Non-conformance has precedence over errors. |
Policy
A policy
for container image binary authorization.
Fields | |
---|---|
name |
Output only. The resource name, in the format |
description |
Optional. A descriptive comment. |
global_policy_evaluation_mode |
Optional. Controls the evaluation of a Google-maintained global admission policy for common system-level images. Images not covered by the global policy will be subject to the project admission policy. This setting has no effect when specified inside a global admission policy. |
admission_whitelist_patterns[] |
Optional. Admission policy allowlisting. A matching admission request will always be permitted. This feature is typically used to exclude Google or third-party infrastructure images from Binary Authorization policies. |
cluster_admission_rules |
Optional. Per-cluster admission rules. Cluster spec format: |
kubernetes_namespace_admission_rules |
Optional. Per-kubernetes-namespace admission rules. K8s namespace spec format: |
kubernetes_service_account_admission_rules |
Optional. Per-kubernetes-service-account admission rules. Service account spec format: |
istio_service_identity_admission_rules |
Optional. Per-istio-service-identity admission rules. Istio service identity spec format: |
default_admission_rule |
Required. Default admission rule for a cluster without a per-cluster, per- kubernetes-service-account, or per-istio-service-identity admission rule. |
update_time |
Output only. Time when the policy was last updated. |
etag |
Optional. A checksum, returned by the server, that can be sent on update requests to ensure the policy has an up-to-date value before attempting to update it. See https://google.aip.dev/154. |
GlobalPolicyEvaluationMode
Enums | |
---|---|
GLOBAL_POLICY_EVALUATION_MODE_UNSPECIFIED |
Not specified: DISABLE is assumed. |
ENABLE |
Enables system policy evaluation. |
DISABLE |
Disables system policy evaluation. |
ReplacePlatformPolicyRequest
Request message for PlatformPolicyManagementService.ReplacePlatformPolicy
.
Fields | |
---|---|
policy |
Required. The replacement Authorization requires the following IAM permission on the specified resource
|
Scope
A scope specifier for CheckSet
objects.
Fields | |
---|---|
Union field scope . A specific type of scope specifier. scope can be only one of the following: |
|
kubernetes_service_account |
Optional. Matches a single Kubernetes service account, e.g. |
kubernetes_namespace |
Optional. Matches all Kubernetes service accounts in the provided namespace, unless a more specific |
SigstoreAuthority
A Sigstore authority, used to verify signatures that are created by Sigstore.
An authority is analogous to an attestation authenticator, verifying that a signature is valid or invalid.
Fields | |
---|---|
display_name |
Optional. A user-provided name for this |
Union field authority . The specific authority type. authority can be only one of the following: |
|
public_key_set |
Required. A simple set of public keys. A signature is considered valid if any keys in the set validate the signature. |
SigstorePublicKey
A Sigstore public key.
SigstorePublicKey
is the public key material used to authenticate Sigstore signatures.
Fields | |
---|---|
public_key_pem |
The public key material in PEM format. |
SigstorePublicKeySet
A bundle of Sigstore public keys, used to verify Sigstore signatures.
A signature is authenticated by a SigstorePublicKeySet
if any of the keys verify it.
Fields | |
---|---|
public_keys[] |
Required. |
SigstoreSignatureCheck
A Sigstore signature check, which verifies the Sigstore signature associated with an image.
Fields | |
---|---|
sigstore_authorities[] |
Required. The authorities required by this check to verify the signature. A signature only needs to be verified by one authority to pass the check. |
SimpleSigningAttestationCheck
Require a signed DSSE attestation with type SimpleSigning.
Fields | |
---|---|
attestation_authenticators[] |
Required. The authenticators required by this check to verify an attestation. Typically this is one or more PKIX public keys for signature verification. Only one authenticator needs to consider an attestation verified in order for an attestation to be considered fully authenticated. In otherwords, this list of authenticators is an "OR" of the authenticator results. At least one authenticator is required. |
container_analysis_attestation_projects[] |
Optional. The projects where attestations are stored as Container Analysis Occurrences, in the format When fetching Occurrences from Container Analysis, only Maximum number of |
SlsaCheck
A SLSA provenance attestation check, which ensures that images are built by a trusted builder using source code from its trusted repositories only.
Fields | |
---|---|
rules[] |
Specifies a list of verification rules for the SLSA attestations. An image is considered compliant with the SlsaCheck if any of the rules are satisfied. |
AttestationSource
Specifies the locations for fetching the provenance attestations.
Fields | |
---|---|
container_analysis_attestation_projects[] |
The IDs of the Google Cloud projects that store the SLSA attestations as Container Analysis Occurrences, in the format Maximum number of |
TrustedBuilder
Supported builders (group).
Enums | |
---|---|
BUILDER_UNSPECIFIED |
Should never happen. |
GOOGLE_CLOUD_BUILD |
The whole Google Cloud Build (GCB) builder group, including all GCB builder types. |
VerificationRule
Specifies verification rules for evaluating the SLSA attestations including: which builders to trust, where to fetch the SLSA attestations generated by those builders, and other builder-specific evaluation rules such as which source repositories are trusted. An image is considered verified by the rule if any of the fetched SLSA attestations is verified.
Fields | |
---|---|
trusted_builder |
Each verification rule is used for evaluation against provenances generated by a specific builder (group). For some of the builders, such as the Google Cloud Build, users don't need to explicitly specify their roots of trust in the policy since the evaluation service can automatically fetch them based on the builder (group). |
attestation_source |
Specifies where to fetch the provenances attestations generated by the builder (group). |
config_based_build_required |
If true, require the image to be built from a top-level configuration. |
trusted_source_repo_patterns[] |
List of trusted source code repository URL patterns. These patterns match the full repository URL without its scheme (e.g. |
TrustedDirectoryCheck
A trusted directory check, which rejects images that do not come from the set of user-configured trusted directories.
Fields | |
---|---|
trusted_dir_patterns[] |
Required. List of trusted directory patterns. A pattern is in the form "registry/path/to/directory". The registry domain part is defined as two or more dot-separated words, e.g., |
UpdateAttestorRequest
Request message for BinauthzManagementServiceV1.UpdateAttestor
.
Fields | |
---|---|
attestor |
Required. The updated Authorization requires the following IAM permission on the specified resource
|
UpdatePolicyRequest
Request message for BinauthzManagementServiceV1.UpdatePolicy
.
Fields | |
---|---|
policy |
Required. A new or updated Authorization requires the following IAM permission on the specified resource
|
UserOwnedGrafeasNote
An user owned Grafeas note
references a Grafeas Attestation.Authority Note created by the user.
Fields | |
---|---|
note_reference |
Required. The Grafeas resource name of a Attestation.Authority Note, created by the user, in the format: An attestation by this attestor is stored as a Grafeas Attestation.Authority Occurrence that names a container image and that links to this Note. Grafeas is an external dependency. |
public_keys[] |
Optional. Public keys that verify attestations signed by this attestor. This field may be updated. If this field is non-empty, one of the specified public keys must verify that an attestation was signed by this attestor for the image specified in the admission request. If this field is empty, this attestor always returns that no valid attestations exist. |
delegation_service_account_email |
Output only. This field will contain the service account email address that this attestor will use as the principal when querying Container Analysis. Attestor administrators must grant this service account the IAM role needed to read attestations from the [note_reference][Note] in Container Analysis ( This email address is fixed for the lifetime of the attestor, but callers should not make any other assumptions about the service account email; future versions may use an email based on a different naming pattern. |
ValidateAttestationOccurrenceRequest
Request message for ValidationHelperV1.ValidateAttestationOccurrence
.
Fields | |
---|---|
attestor |
Required. The resource name of the Authorization requires the following IAM permission on the specified resource
|
attestation |
Required. An |
occurrence_note |
Required. The resource name of the [Note][grafeas.v1.Note] to which the containing [Occurrence][grafeas.v1.Occurrence] is associated. |
occurrence_resource_uri |
Required. The URI of the artifact (e.g. container image) that is the subject of the containing [Occurrence][grafeas.v1.Occurrence]. |
ValidateAttestationOccurrenceResponse
Response message for ValidationHelperV1.ValidateAttestationOccurrence
.
Fields | |
---|---|
result |
The result of the Attestation validation. |
denial_reason |
The reason for denial if the Attestation couldn't be validated. |
Result
The enum returned in the result
field.
Enums | |
---|---|
RESULT_UNSPECIFIED |
Unspecified. |
VERIFIED |
The Attestation was able to verified by the Attestor. |
ATTESTATION_NOT_VERIFIABLE |
The Attestation was not able to verified by the Attestor. |
VulnerabilityCheck
An image vulnerability check, which rejects images that violate the configured vulnerability rules.
Fields | |
---|---|
allowed_cves[] |
Optional. A list of specific CVEs to ignore even if the vulnerability level violates |
blocked_cves[] |
Optional. A list of specific CVEs to always raise warnings about even if the vulnerability level meets |
maximum_unfixable_severity |
Required. The threshold for severity for which a fix isn't currently available. This field is required and must be set. |
maximum_fixable_severity |
Required. The threshold for severity for which a fix is currently available. This field is required and must be set. |
container_analysis_vulnerability_projects[] |
Optional. The projects where vulnerabilities are stored as Container Analysis Occurrences. Each project is expressed in the resource format of Maximum number of |
MaximumAllowedSeverity
Maximum allowed severity level which is compared to an image's effective
severity
defined by Container Analysis: https://cloud.google.com/container-analysis/docs/container-scanning-overview#sources.
Enums | |
---|---|
MAXIMUM_ALLOWED_SEVERITY_UNSPECIFIED |
Not specified. |
BLOCK_ALL |
Block any vulnerability. |
MINIMAL |
Allow only minimal severity. |
LOW |
Allow only low severity and lower. |
MEDIUM |
Allow medium severity and lower. |
HIGH |
Allow high severity and lower. |
CRITICAL |
Allow critical severity and lower. |
ALLOW_ALL |
Allow all severity, even vulnerability with unspecified severity. |