Organization Policy API 使用 Kubernetes 自訂資源，並依賴 Kubernetes 資源模型 (KRM)。用於管理機構政策的生命週期，例如建立、更新及刪除政策。
如要使用 Organization Policy API，建議使用 Kubernetes CLI kubectl。如果您的應用程式需要使用自己的程式庫呼叫這項 API，請使用下列範例、完整 API 定義和專屬的政策比對頁面來建構要求。
服務端點和探索文件
Organization Policy API 的 API 端點為：
https://MANAGEMENT_API_SERVER_ENDPOINT/apis/constraints.gatekeeper.sh/v1beta1
其中 MANAGEMENT_API_SERVER_ENDPOINT 是 Management API 伺服器的端點。
使用 kubectl proxy 指令，您可以在瀏覽器中存取該網址，也可以使用 curl 等工具，取得 Organization Policy API 的探索文件。kubectl proxy 指令會在您的本機電腦上開啟 Kubernetes API 伺服器的 Proxy。執行該指令後，您就可以透過下列網址存取文件：
http://127.0.0.1:8001/apis/constraints.gatekeeper.sh/v1beta1。
KRM 範例
以下範例是 Organization Policy API 中的 GDCHRestrictedServices 物件，可將 Database Service 的使用限制在具有 owner: dba-team 標籤的專案。
apiVersion:constraints.gatekeeper.sh/v1beta1kind:GDCHRestrictedServicemetadata:name:db-restricted-to-dbasspec:match:scope:NamespacednamespaceSelector:matchExpressions:# We are restricting the use of the service in namespaces that# DON'T have the owner: dba-team label-key:owneroperator:NotInvalues:-dba-teamkinds:-apiGroups:-"postgresql.ods.anthosapis.com"kinds:-Dbclusters-Backupplans-Imports-Restores-apiGroups:-"oracle.ods.anthosapis.com"kinds:-Dbclusters-Backupplans-Importsparameters:disabledOperations:-"UPDATE"-"CREATE"
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[[["\u003cp\u003eThe Organization Policy API uses Kubernetes custom resources and the Kubernetes Resource Model (KRM) to manage the lifecycle of organization policies.\u003c/p\u003e\n"],["\u003cp\u003eIt is recommended to use the Kubernetes CLI \u003ccode\u003ekubectl\u003c/code\u003e to interact with the Organization Policy API, but alternative methods are available using the provided API definition.\u003c/p\u003e\n"],["\u003cp\u003eThe API endpoint is located at \u003ccode\u003ehttps://<GDCH_API_SERVER_ENDPOINT>/apis/constraints.gatekeeper.sh/v1beta1\u003c/code\u003e, with a discovery document accessible via \u003ccode\u003ekubectl proxy\u003c/code\u003e.\u003c/p\u003e\n"],["\u003cp\u003eAn example of the API is shown that uses the \u003ccode\u003eGDCHRestrictedServices\u003c/code\u003e object to restrict the use of the database service to namespaces that have the \u003ccode\u003eowner: dba-team\u003c/code\u003e label.\u003c/p\u003e\n"]]],[],null,["# Organization Policy API overview\n\nThe Organization Policy API uses Kubernetes custom resources and relies on the\nKubernetes Resource Model (KRM). It is used to manage the lifecycle of\norganization policies such as creating, updating, deleting.\n\nTo use the Organization Policy API, we recommend that you use the Kubernetes CLI\n`kubectl`. If your application needs to use its own libraries to call this API,\nuse the following example, the [full API definition](/distributed-cloud/hosted/docs/latest/appliance/apis/service/org-policy/org-policy-krm-api), and the\ndedicated [policy match page](/distributed-cloud/hosted/docs/latest/appliance/apis/service/org-policy/policy-match-section) to build your requests.\n| **Warning:** While organization policies leverage an open-source API that's marked as beta (`constraints.gatekeeper.sh/v1beta1`), the organization policy system itself is in alpha. Additional APIs may be introduced in the future to facilitate the management of organisation policies.\n\nService endpoint and discovery document\n---------------------------------------\n\nThe API endpoint for the Organization Policy API is:\n`https://`\u003cvar translate=\"no\"\u003eMANAGEMENT_API_SERVER_ENDPOINT\u003c/var\u003e`/apis/constraints.gatekeeper.sh/v1beta1`\nwhere \u003cvar translate=\"no\"\u003eMANAGEMENT_API_SERVER_ENDPOINT\u003c/var\u003e is the endpoint of the\nManagement API server.\n\nUsing the `kubectl proxy` command, you can access that URL in your browser or\nwith a tool such as `curl` to get the discovery document for the Organization\nPolicy API. The `kubectl proxy` command opens up a proxy to the Kubernetes API\nserver on your local machine. Once that command is running, you can access the\ndocument at the following URL:\n`http://127.0.0.1:8001/apis/constraints.gatekeeper.sh/v1beta1`.\n\nExample KRM\n-----------\n\nThe following example is a `GDCHRestrictedServices` object in the Organization\nPolicy API to restrict the use of the Database Service to projects that\nhave the label `owner: dba-team`. \n\n apiVersion: constraints.gatekeeper.sh/v1beta1\n kind: GDCHRestrictedService\n metadata:\n name: db-restricted-to-dbas\n spec:\n match:\n scope: Namespaced\n namespaceSelector:\n matchExpressions:\n # We are restricting the use of the service in namespaces that\n # DON'T have the owner: dba-team label\n - key: owner\n operator: NotIn\n values:\n - dba-team\n kinds:\n - apiGroups:\n - \"postgresql.ods.anthosapis.com\"\n kinds:\n - Dbclusters\n - Backupplans\n - Imports\n - Restores\n - apiGroups:\n - \"oracle.ods.anthosapis.com\"\n kinds:\n - Dbclusters\n - Backupplans\n - Imports\n parameters:\n disabledOperations:\n - \"UPDATE\"\n - \"CREATE\""]]
