Organization Policy API 使用 Kubernetes 自訂資源，並依賴 Kubernetes 資源模型 (KRM)。用於管理機構政策的生命週期，例如建立、更新及刪除政策。
如要使用 Organization Policy API，建議使用 Kubernetes CLI kubectl。如果您的應用程式需要使用自己的程式庫呼叫這項 API，請使用下列範例、完整 API 定義和專屬的政策比對頁面來建構要求。
服務端點和探索文件
Organization Policy API 的 API 端點為：
https://MANAGEMENT_API_SERVER_ENDPOINT/apis/constraints.gatekeeper.sh/v1beta1
其中 MANAGEMENT_API_SERVER_ENDPOINT 是 Management API 伺服器的端點。
使用 kubectl proxy 指令，您可以在瀏覽器中存取該網址，也可以使用 curl 等工具，取得 Organization Policy API 的探索文件。kubectl proxy 指令會在您的本機電腦上開啟 Kubernetes API 伺服器的 Proxy。執行該指令後，您可以在下列網址存取文件：http://127.0.0.1:8001/apis/constraints.gatekeeper.sh/v1beta1。
apiVersion:constraints.gatekeeper.sh/v1beta1kind:GDCHRestrictedServicemetadata:name:db-restricted-to-dbasspec:match:scope:NamespacednamespaceSelector:matchExpressions:# We are restricting the use of the service in namespaces that# DON'T have the owner: dba-team label-key:owneroperator:NotInvalues:-dba-teamkinds:-apiGroups:-"postgresql.ods.anthosapis.com"kinds:-Dbclusters-Backupplans-Imports-Restores-apiGroups:-"oracle.ods.anthosapis.com"kinds:-Dbclusters-Backupplans-Importsparameters:disabledOperations:-"UPDATE"-"CREATE"
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[[["\u003cp\u003eThe Organization Policy API, which manages the lifecycle of organization policies, utilizes Kubernetes custom resources and the Kubernetes Resource Model (KRM).\u003c/p\u003e\n"],["\u003cp\u003e\u003ccode\u003ekubectl\u003c/code\u003e is the recommended CLI for interacting with the Organization Policy API; however, custom libraries can be used by referencing the provided API definition and policy match page.\u003c/p\u003e\n"],["\u003cp\u003eThe Organization Policy API endpoint is accessible via \u003ccode\u003ehttps://<MANAGEMENT_API_SERVER_ENDPOINT>/apis/constraints.gatekeeper.sh/v1beta1\u003c/code\u003e, with the \u003ccode\u003ekubectl proxy\u003c/code\u003e command enabling local access to the discovery document.\u003c/p\u003e\n"],["\u003cp\u003eThe API is currently in alpha, but uses an open-source beta API, and future APIs may be added to enhance the management of organization policies.\u003c/p\u003e\n"],["\u003cp\u003eAn example is provided of a \u003ccode\u003eGDCHRestrictedServices\u003c/code\u003e object that restricts database service use to projects with the \u003ccode\u003eowner: dba-team\u003c/code\u003e label and disables \u003ccode\u003eUPDATE\u003c/code\u003e and \u003ccode\u003eCREATE\u003c/code\u003e operations.\u003c/p\u003e\n"]]],[],null,["# Organization Policy API overview\n\nThe Organization Policy API uses Kubernetes custom resources and relies on the\nKubernetes Resource Model (KRM). It is used to manage the lifecycle of\norganization policies such as creating, updating, deleting.\n\nTo use the Organization Policy API, we recommend that you use the Kubernetes CLI\n`kubectl`. If your application needs to use its own libraries to call this API,\nuse the following example, the [full API definition](/distributed-cloud/hosted/docs/latest/gdch/apis/service/org-policy/org-policy-krm-api), and\nthe dedicated [policy match page](/distributed-cloud/hosted/docs/latest/gdch/apis/service/org-policy/policy-match-section) to build your requests.\n| **Warning:** While organization policies use an open-source API that's marked as beta (`constraints.gatekeeper.sh/v1beta1`), the organization policy system itself is in alpha. Additional APIs may be introduced in the future to facilitate the management of organisation policies.\n\nService endpoint and discovery document\n---------------------------------------\n\nThe API endpoint for the Organization Policy API is:\n`https://`\u003cvar translate=\"no\"\u003eMANAGEMENT_API_SERVER_ENDPOINT\u003c/var\u003e`/apis/constraints.gatekeeper.sh/v1beta1`\nwhere \u003cvar translate=\"no\"\u003eMANAGEMENT_API_SERVER_ENDPOINT\u003c/var\u003e is the endpoint of the\nManagement API server.\n\nUsing the `kubectl proxy` command, you can access that URL in your browser or\nwith a tool such as `curl` to get the discovery document for the Organization\nPolicy API. The `kubectl proxy` command opens up a proxy to the Kubernetes API\nserver on your local machine. After that command is running, you can access the\ndocument at the following URL:\n`http://127.0.0.1:8001/apis/constraints.gatekeeper.sh/v1beta1`.\n\nExample KRM\n-----------\n\nThe following is an example of a `GDCHRestrictedServices` object in the\nOrganization Policy API to restrict the use of the Database Services to projects\nthat have the label `owner: dba-team`. \n\n apiVersion: constraints.gatekeeper.sh/v1beta1\n kind: GDCHRestrictedService\n metadata:\n name: db-restricted-to-dbas\n spec:\n match:\n scope: Namespaced\n namespaceSelector:\n matchExpressions:\n # We are restricting the use of the service in namespaces that\n # DON'T have the owner: dba-team label\n - key: owner\n operator: NotIn\n values:\n - dba-team\n kinds:\n - apiGroups:\n - \"postgresql.ods.anthosapis.com\"\n kinds:\n - Dbclusters\n - Backupplans\n - Imports\n - Restores\n - apiGroups:\n - \"oracle.ods.anthosapis.com\"\n kinds:\n - Dbclusters\n - Backupplans\n - Imports\n parameters:\n disabledOperations:\n - \"UPDATE\"\n - \"CREATE\""]]
