組織のポリシー API は Kubernetes カスタム リソースを使用し、Kubernetes Resource Model（KRM）に依存しています。組織のポリシーのライフサイクル（作成、更新、削除など）の管理に使用されます。
Organization Policy API を使用するには、Kubernetes CLI kubectl を使用することをおすすめします。アプリケーションで独自のライブラリを使用してこの API を呼び出す必要がある場合は、次の例、完全な API 定義、専用のポリシー一致ページを使用してリクエストを作成します。
サービス エンドポイントとディスカバリ ドキュメント
Organization Policy API の API エンドポイントは https://MANAGEMENT_API_SERVER_ENDPOINT/apis/constraints.gatekeeper.sh/v1beta1 です。ここで、MANAGEMENT_API_SERVER_ENDPOINT は Management API サーバーのエンドポイントです。
kubectl proxy コマンドを使用すると、ブラウザまたは curl などのツールでその URL にアクセスして、組織のポリシー API のディスカバリ ドキュメントを取得できます。kubectl proxy コマンドは、ローカルマシンの Kubernetes API サーバーへのプロキシを開きます。このコマンドが実行されると、次の URL でドキュメントにアクセスできます。http://127.0.0.1:8001/apis/constraints.gatekeeper.sh/v1beta1
KRM の例
次の例は、Organization Policy API の GDCHRestrictedServices オブジェクトで、ラベル owner: dba-team を持つプロジェクトに Database Service の使用を制限しています。
apiVersion:constraints.gatekeeper.sh/v1beta1kind:GDCHRestrictedServicemetadata:name:db-restricted-to-dbasspec:match:scope:NamespacednamespaceSelector:matchExpressions:# We are restricting the use of the service in namespaces that# DON'T have the owner: dba-team label-key:owneroperator:NotInvalues:-dba-teamkinds:-apiGroups:-"postgresql.ods.anthosapis.com"kinds:-Dbclusters-Backupplans-Imports-Restores-apiGroups:-"oracle.ods.anthosapis.com"kinds:-Dbclusters-Backupplans-Importsparameters:disabledOperations:-"UPDATE"-"CREATE"
[[["わかりやすい","easyToUnderstand","thumb-up"],["問題の解決に役立った","solvedMyProblem","thumb-up"],["その他","otherUp","thumb-up"]],[["わかりにくい","hardToUnderstand","thumb-down"],["情報またはサンプルコードが不正確","incorrectInformationOrSampleCode","thumb-down"],["必要な情報 / サンプルがない","missingTheInformationSamplesINeed","thumb-down"],["翻訳に関する問題","translationIssue","thumb-down"],["その他","otherDown","thumb-down"]],["最終更新日 2025-09-04 UTC。"],[[["\u003cp\u003eThe Organization Policy API uses Kubernetes custom resources and the Kubernetes Resource Model (KRM) to manage the lifecycle of organization policies.\u003c/p\u003e\n"],["\u003cp\u003eIt is recommended to use the Kubernetes CLI \u003ccode\u003ekubectl\u003c/code\u003e to interact with the Organization Policy API, but alternative methods are available using the provided API definition.\u003c/p\u003e\n"],["\u003cp\u003eThe API endpoint is located at \u003ccode\u003ehttps://<GDCH_API_SERVER_ENDPOINT>/apis/constraints.gatekeeper.sh/v1beta1\u003c/code\u003e, with a discovery document accessible via \u003ccode\u003ekubectl proxy\u003c/code\u003e.\u003c/p\u003e\n"],["\u003cp\u003eAn example of the API is shown that uses the \u003ccode\u003eGDCHRestrictedServices\u003c/code\u003e object to restrict the use of the database service to namespaces that have the \u003ccode\u003eowner: dba-team\u003c/code\u003e label.\u003c/p\u003e\n"]]],[],null,["# Organization Policy API overview\n\nThe Organization Policy API uses Kubernetes custom resources and relies on the\nKubernetes Resource Model (KRM). It is used to manage the lifecycle of\norganization policies such as creating, updating, deleting.\n\nTo use the Organization Policy API, we recommend that you use the Kubernetes CLI\n`kubectl`. If your application needs to use its own libraries to call this API,\nuse the following example, the [full API definition](/distributed-cloud/hosted/docs/latest/appliance/apis/service/org-policy/org-policy-krm-api), and the\ndedicated [policy match page](/distributed-cloud/hosted/docs/latest/appliance/apis/service/org-policy/policy-match-section) to build your requests.\n| **Warning:** While organization policies leverage an open-source API that's marked as beta (`constraints.gatekeeper.sh/v1beta1`), the organization policy system itself is in alpha. Additional APIs may be introduced in the future to facilitate the management of organisation policies.\n\nService endpoint and discovery document\n---------------------------------------\n\nThe API endpoint for the Organization Policy API is:\n`https://`\u003cvar translate=\"no\"\u003eMANAGEMENT_API_SERVER_ENDPOINT\u003c/var\u003e`/apis/constraints.gatekeeper.sh/v1beta1`\nwhere \u003cvar translate=\"no\"\u003eMANAGEMENT_API_SERVER_ENDPOINT\u003c/var\u003e is the endpoint of the\nManagement API server.\n\nUsing the `kubectl proxy` command, you can access that URL in your browser or\nwith a tool such as `curl` to get the discovery document for the Organization\nPolicy API. The `kubectl proxy` command opens up a proxy to the Kubernetes API\nserver on your local machine. Once that command is running, you can access the\ndocument at the following URL:\n`http://127.0.0.1:8001/apis/constraints.gatekeeper.sh/v1beta1`.\n\nExample KRM\n-----------\n\nThe following example is a `GDCHRestrictedServices` object in the Organization\nPolicy API to restrict the use of the Database Service to projects that\nhave the label `owner: dba-team`. \n\n apiVersion: constraints.gatekeeper.sh/v1beta1\n kind: GDCHRestrictedService\n metadata:\n name: db-restricted-to-dbas\n spec:\n match:\n scope: Namespaced\n namespaceSelector:\n matchExpressions:\n # We are restricting the use of the service in namespaces that\n # DON'T have the owner: dba-team label\n - key: owner\n operator: NotIn\n values:\n - dba-team\n kinds:\n - apiGroups:\n - \"postgresql.ods.anthosapis.com\"\n kinds:\n - Dbclusters\n - Backupplans\n - Imports\n - Restores\n - apiGroups:\n - \"oracle.ods.anthosapis.com\"\n kinds:\n - Dbclusters\n - Backupplans\n - Imports\n parameters:\n disabledOperations:\n - \"UPDATE\"\n - \"CREATE\""]]
