REST Resource: organizations.locations.global.policyOrchestrators

Resource: PolicyOrchestrator

PolicyOrchestrator helps managing project+zone level policy resources (e.g. OS Policy Assignments), by providing tools to create, update and delete them across projects and locations, at scale.

Policy orchestrator functions as an endless loop. Each iteration orchestrator computes a set of resources that should be affected, then progressively applies changes to them. If for some reason this set of resources changes over time (e.g. new projects are added), the future loop iterations will address that.

Orchestrator can either upsert or delete policy resources. For more details, see the description of the action, and orchestratedResource fields.

Note that policy orchestrator do not "manage" the resources it creates. Every iteration is independent and only minimal history of past actions is retained (apart from Cloud Logging). If orchestrator gets deleted, it does not affect the resources it created in the past. Those will remain where they were. Same applies if projects are removed from the orchestrator's scope.

JSON representation 
{
  "name": string,
  "description": string,
  "etag": string,
  "state": string,
  "reconciling": boolean,
  "orchestrationScope": {
    object (OrchestrationScope)
  },
  "action": string,
  "orchestratedResource": {
    object (OrchestratedResource)
  },
  "orchestrationState": {
    object (OrchestrationState)
  },
  "createTime": string,
  "updateTime": string,
  "labels": {
    string: string,
    ...
  }
}
Fields
name

string

Immutable. Identifier. In form of * organizations/{organization_id}/locations/global/policyOrchestrators/{orchestrator_id} * folders/{folder_id}/locations/global/policyOrchestrators/{orchestrator_id} * projects/{project_id_or_number}/locations/global/policyOrchestrators/{orchestrator_id}
description

string

Optional. Freeform text describing the purpose of the resource.
etag

string

Output only. This checksum is computed by the server based on the value of other fields, and may be sent on update and delete requests to ensure the client has an up-to-date value before proceeding.
state

string

Optional. State of the orchestrator. Can be updated to change orchestrator behaviour. Allowed values: - ACTIVE - orchestrator is actively looking for actions to be taken. - STOPPED - orchestrator won't make any changes.

Note: There might be more states added in the future. We use string here instead of an enum, to avoid the need of propagating new states to all the client code.
reconciling

boolean

Output only. Set to true, if the there are ongoing changes being applied by the orchestrator.
orchestrationScope

object (OrchestrationScope)

Optional. Defines scope for the orchestration, in context of the enclosing PolicyOrchestrator resource.

Scope is expanded into a list of <project, zone> pairs, in which the rollout action will take place. Expansion starts with a Folder resource parenting the PolicyOrchestrator resource: - All the descendant projects are listed. - List of project is cross joined with a list of all available zones. - Resulting list of <project, zone> pairs is filtered according to the selectors.
action

string

Required. Action to be done by the orchestrator in projects/{projectId}/zones/{zone_id} locations defined by the orchestrationScope. Allowed values: - UPSERT - Orchestrator will create or update target resources. - DELETE - Orchestrator will delete target resources, if they exist
orchestratedResource

object (OrchestratedResource)

Required. Resource to be orchestrated by the policy orchestrator.
orchestrationState

object (OrchestrationState)

Output only. State of the orchestration.
createTime

string (Timestamp format)

Output only. Timestamp when the policy orchestrator resource was created.

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
updateTime

string (Timestamp format)

Output only. Timestamp when the policy orchestrator resource was last modified.

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
labels

map (key: string, value: string)

Optional. Labels as key value pairs

An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.

Methods

create

 Creates a new policy orchestrator under the given organizations resource.

delete

 Deletes an existing policy orchestrator resource, parented by an organization.

get

 Retrieves an existing policy orchestrator, parented by an organization.

list

 Lists the policy orchestrators under the given parent organization resource.

patch

 Updates an existing policy orchestrator, parented by an organization.