Descripción general de la API de Organization Policy
Organiza tus páginas con colecciones
Guarda y categoriza el contenido según tus preferencias.
La API de Organization Policy usa recursos personalizados de Kubernetes y se basa en el modelo de recursos de Kubernetes (KRM). Se usa para administrar el ciclo de vida de las políticas de la organización, como la creación, la actualización y la eliminación.
Para usar la API de Organization Policy, te recomendamos que uses la CLI de Kubernetes kubectl. Si tu aplicación necesita usar sus propias bibliotecas para llamar a esta API, usa el siguiente ejemplo, la definición completa de la API y la página de coincidencias de políticas dedicada para compilar tus solicitudes.
Extremo de servicio y documento de descubrimiento
El extremo de API de Organization Policy es el siguiente:
https://MANAGEMENT_API_SERVER_ENDPOINT/apis/constraints.gatekeeper.sh/v1beta1
donde MANAGEMENT_API_SERVER_ENDPOINT es el extremo del servidor de la API de Management.
Con el comando kubectl proxy, puedes acceder a esa URL en tu navegador o con una herramienta como curl para obtener el documento de descubrimiento de la API de Organization Policy. El comando kubectl proxy abre un proxy al servidor de la API de Kubernetes en tu máquina local. Después de que se ejecute ese comando, puedes acceder al documento en la siguiente URL: http://127.0.0.1:8001/apis/constraints.gatekeeper.sh/v1beta1.
Ejemplo de KRM
A continuación, se muestra un ejemplo de un objeto GDCHRestrictedServices en la API de Organization Policy para restringir el uso de los servicios de bases de datos a los proyectos que tienen la etiqueta owner: dba-team.
apiVersion:constraints.gatekeeper.sh/v1beta1kind:GDCHRestrictedServicemetadata:name:db-restricted-to-dbasspec:match:scope:NamespacednamespaceSelector:matchExpressions:# We are restricting the use of the service in namespaces that# DON'T have the owner: dba-team label-key:owneroperator:NotInvalues:-dba-teamkinds:-apiGroups:-"postgresql.ods.anthosapis.com"kinds:-Dbclusters-Backupplans-Imports-Restores-apiGroups:-"oracle.ods.anthosapis.com"kinds:-Dbclusters-Backupplans-Importsparameters:disabledOperations:-"UPDATE"-"CREATE"
[[["Fácil de comprender","easyToUnderstand","thumb-up"],["Resolvió mi problema","solvedMyProblem","thumb-up"],["Otro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Información o código de muestra incorrectos","incorrectInformationOrSampleCode","thumb-down"],["Faltan la información o los ejemplos que necesito","missingTheInformationSamplesINeed","thumb-down"],["Problema de traducción","translationIssue","thumb-down"],["Otro","otherDown","thumb-down"]],["Última actualización: 2025-09-04 (UTC)"],[[["\u003cp\u003eThe Organization Policy API, which manages the lifecycle of organization policies, utilizes Kubernetes custom resources and the Kubernetes Resource Model (KRM).\u003c/p\u003e\n"],["\u003cp\u003e\u003ccode\u003ekubectl\u003c/code\u003e is the recommended CLI for interacting with the Organization Policy API; however, custom libraries can be used by referencing the provided API definition and policy match page.\u003c/p\u003e\n"],["\u003cp\u003eThe Organization Policy API endpoint is accessible via \u003ccode\u003ehttps://<MANAGEMENT_API_SERVER_ENDPOINT>/apis/constraints.gatekeeper.sh/v1beta1\u003c/code\u003e, with the \u003ccode\u003ekubectl proxy\u003c/code\u003e command enabling local access to the discovery document.\u003c/p\u003e\n"],["\u003cp\u003eThe API is currently in alpha, but uses an open-source beta API, and future APIs may be added to enhance the management of organization policies.\u003c/p\u003e\n"],["\u003cp\u003eAn example is provided of a \u003ccode\u003eGDCHRestrictedServices\u003c/code\u003e object that restricts database service use to projects with the \u003ccode\u003eowner: dba-team\u003c/code\u003e label and disables \u003ccode\u003eUPDATE\u003c/code\u003e and \u003ccode\u003eCREATE\u003c/code\u003e operations.\u003c/p\u003e\n"]]],[],null,["# Organization Policy API overview\n\nThe Organization Policy API uses Kubernetes custom resources and relies on the\nKubernetes Resource Model (KRM). It is used to manage the lifecycle of\norganization policies such as creating, updating, deleting.\n\nTo use the Organization Policy API, we recommend that you use the Kubernetes CLI\n`kubectl`. If your application needs to use its own libraries to call this API,\nuse the following example, the [full API definition](/distributed-cloud/hosted/docs/latest/gdch/apis/service/org-policy/org-policy-krm-api), and\nthe dedicated [policy match page](/distributed-cloud/hosted/docs/latest/gdch/apis/service/org-policy/policy-match-section) to build your requests.\n| **Warning:** While organization policies use an open-source API that's marked as beta (`constraints.gatekeeper.sh/v1beta1`), the organization policy system itself is in alpha. Additional APIs may be introduced in the future to facilitate the management of organisation policies.\n\nService endpoint and discovery document\n---------------------------------------\n\nThe API endpoint for the Organization Policy API is:\n`https://`\u003cvar translate=\"no\"\u003eMANAGEMENT_API_SERVER_ENDPOINT\u003c/var\u003e`/apis/constraints.gatekeeper.sh/v1beta1`\nwhere \u003cvar translate=\"no\"\u003eMANAGEMENT_API_SERVER_ENDPOINT\u003c/var\u003e is the endpoint of the\nManagement API server.\n\nUsing the `kubectl proxy` command, you can access that URL in your browser or\nwith a tool such as `curl` to get the discovery document for the Organization\nPolicy API. The `kubectl proxy` command opens up a proxy to the Kubernetes API\nserver on your local machine. After that command is running, you can access the\ndocument at the following URL:\n`http://127.0.0.1:8001/apis/constraints.gatekeeper.sh/v1beta1`.\n\nExample KRM\n-----------\n\nThe following is an example of a `GDCHRestrictedServices` object in the\nOrganization Policy API to restrict the use of the Database Services to projects\nthat have the label `owner: dba-team`. \n\n apiVersion: constraints.gatekeeper.sh/v1beta1\n kind: GDCHRestrictedService\n metadata:\n name: db-restricted-to-dbas\n spec:\n match:\n scope: Namespaced\n namespaceSelector:\n matchExpressions:\n # We are restricting the use of the service in namespaces that\n # DON'T have the owner: dba-team label\n - key: owner\n operator: NotIn\n values:\n - dba-team\n kinds:\n - apiGroups:\n - \"postgresql.ods.anthosapis.com\"\n kinds:\n - Dbclusters\n - Backupplans\n - Imports\n - Restores\n - apiGroups:\n - \"oracle.ods.anthosapis.com\"\n kinds:\n - Dbclusters\n - Backupplans\n - Imports\n parameters:\n disabledOperations:\n - \"UPDATE\"\n - \"CREATE\""]]
