每项组织政策都具有关联的 IAM 角色。向您希望管理相应组织政策的用户和群组授予该 IAM 角色。如需允许用户或群组创建、更新或删除类型为 GDCHRestrictedService 的政策，请为该用户或群组分配 gdchrestrictedservice-policy-manager IAM 角色。
apiVersion:constraints.gatekeeper.sh/v1beta1
kind:GDCHRestrictedService
metadata:
name:db-restricted-to-dbas
spec:
match:
scope:Namespaced
namespaceSelector:
matchExpressions:
# We are restricting the use of the service in namespaces that# don't have the owner: dba-team label-key:owner
operator:NotIn
values:
-dba-team
kinds:
-apiGroups:
-"postgresql.dbadmin.gdc.goog"kinds:
-DBCluster
-BackupPlan
-Import
-Restore
-apiGroups:
-"oracle.dbadmin.gdc.goog"kinds:
-DBCluster
-BackupPlan
-Import
parameters:
disabledOperations:
-"UPDATE"-"CREATE"
回滚现有政策
如需停止强制执行现有政策，请使用 kubectl CLI 将其删除。使用可让您访问定义政策的集群和 gdchrestrictedservice-policy-manager IAM 角色的 kubeconfig 文件。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-04。"],[[["\u003cp\u003eOrganization policies in Google Distributed Cloud (GDC) air-gapped provide centralized control over resources, enabling administrators to set restrictions and guardrails using the API or \u003ccode\u003ekubectl\u003c/code\u003e CLI.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003eGDCHRestrictedService\u003c/code\u003e policy type allows administrators to restrict the use of specific services on GDC by blocking \u003ccode\u003eCREATE\u003c/code\u003e and \u003ccode\u003eUPDATE\u003c/code\u003e operations, and it supports various services such as Marketplace, Vertex AI Workbench, and Database Services.\u003c/p\u003e\n"],["\u003cp\u003eIAM is used for managing who can perform actions, while organization policies determine what restrictions are placed on specific resources and their configuration.\u003c/p\u003e\n"],["\u003cp\u003eOrganization policies can be scoped to specific namespaces or exclude certain namespaces, using parameters like \u003ccode\u003eexcludedNamespaces\u003c/code\u003e, \u003ccode\u003enamespaceSelector\u003c/code\u003e, \u003ccode\u003enamespaces\u003c/code\u003e, and \u003ccode\u003escope\u003c/code\u003e in the policy definition.\u003c/p\u003e\n"],["\u003cp\u003ePolicies can be tested in \u003ccode\u003edryrun\u003c/code\u003e or \u003ccode\u003ewarn\u003c/code\u003e modes before full enforcement to avoid breaking existing systems, and they can be deleted using the \u003ccode\u003ekubectl\u003c/code\u003e CLI to stop enforcement.\u003c/p\u003e\n"]]],[],null,["# Configure organization policies\n\nOrganization policies give you centralized and programmatic control over your\norganization's resources. As the organization policy administrator, you can\nconfigure policies across your entire organization.\n\nIn this version of Google Distributed Cloud (GDC) air-gapped, there is no UI or CLI for\norganization policies. You must use the API or `kubectl` CLI to manage them.\n| **Note:** The organization policies system leverages Open Policy Agent - Gatekeeper, an open-source project whose API is marked as beta (`constraints.gatekeeper.sh/v1beta1`).\n\nBenefits\n--------\n\nConfiguring organization policies provides several benefits:\n\n- Centralize control to configure restrictions on how to use your organization's resources.\n- Define and establish guardrails for your development teams to stay within compliance boundaries.\n- Help project owners and their teams move quickly without breaking compliance.\n\n### Differences from Identity and Access Management\n\n[Identity and Access Management](/distributed-cloud/hosted/docs/latest/gdch/platform/pa-user/iam) focuses on\n*who*, and lets the administrator authorize who can take action on specific\nresources based on permissions.\n\nOrganization policies focus on *what*, and let the administrator set\nrestrictions on specific resources to determine how to configure them.\n\n### List of available organization policy types\n\nIn this release of GDC, you can use the following policy\ntype.\n\n#### GDCHRestrictedService\n\nThe `GDCHRestrictedService` policy type lets you restrict which service you can use on\nGDC. When applied, the policy prevents the use of the APIs\nthat it references. For example, you can use this policy type to restrict the\nuse of a given service to certain projects. You can also use the policy to\ncompletely restrict the access to a new GDC service that you\nwant to run tests on before allowing your teams to use it.\n\nCreate this policy in the same cluster as the service resources. You can create\nmultiple instances of this policy for different services or different projects.\n\nThe following is a template for this policy: \n\n apiVersion: constraints.gatekeeper.sh/v1beta1\n kind: GDCHRestrictedService\n metadata:\n name: \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-l devsite-syntax-l-Scalar devsite-syntax-l-Scalar-Plain\"\u003ePOLICY_NAME\u003c/span\u003e\u003c/var\u003e\n spec:\n match:\n \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-l devsite-syntax-l-Scalar devsite-syntax-l-Scalar-Plain\"\u003eMATCH_SCHEMA\u003c/span\u003e\u003c/var\u003e\n parameters:\n disabledOperations:\n - \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-l devsite-syntax-l-Scalar devsite-syntax-l-Scalar-Plain\"\u003eDISABLED_OPERATION\u003c/span\u003e\u003c/var\u003e\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003ePOLICY_NAME\u003c/var\u003e: the name of the organization policy.\n\n- \u003cvar translate=\"no\"\u003eMATCH_SCHEMA\u003c/var\u003e: the resources to match for this\n constraint. See the\n [Define the scope of an organization policy within a cluster](#define-org-policy-within-cluster)\n section for more information.\n\n- \u003cvar translate=\"no\"\u003eDISABLED_OPERATION\u003c/var\u003e: the groups of operations that\n this policy blocks. The allowed values are `CREATE` and `UPDATE`. The default\n value for the `disabledOperations` field is `*`.\n\nThe `GDCHRestrictedService` policy only supports the `UPDATE` and `CREATE` operations. To\nrestrict the `GET`, `LIST`, and `DELETE` operations, we recommend that you\n[use IAM](/distributed-cloud/hosted/docs/latest/gdch/platform/pa-user/iam) to assign roles.\n\nThe `GDCHRestrictedService` policy only supports the following subset of the available\nservices on GDC.\n\nYou do not have to specify all of the kinds for a given service. You can\nrestrict the usage of a subset of a service's features by specifying only the\ncorresponding kinds.\n| **Warning:** Always specify kinds for a given API group, and ensure they are singular and use the correct case. Do not use kinds that are not listed in this documentation. This might cause unintended consequences.\n\nFor example, to restrict updates to marketplace services, create the following\npolicy: \n\n apiVersion: constraints.gatekeeper.sh/v1beta1\n kind: GDCHRestrictedService\n metadata:\n name: no-update-to-marketplace-service\n spec:\n match:\n kinds:\n - apiGroups:\n - \"marketplace.gdc.goog\"\n kinds:\n - MarketplaceService\n parameters:\n disabledOperations:\n - \"UPDATE\"\n\nThis policy prevents any `UPDATE` operation on any `marketplace.gdc.goog` API\ngroup with the value of `MarketplaceService` for its kind. In effect, this\npolicy prevents anyone from modifying any Marketplace service.\n\nTo completely disable a service, list both `CREATE` and `UPDATE` in the\n`disabledOperations` parameter, and list all the kinds documented here.\n\nGrant IAM roles to manage organization policies\n-----------------------------------------------\n\nEach organization policy has an associated IAM role. Grant the IAM role to the\nusers and groups that you want to manage that specific organization policy. To\nallow a user or group the ability to create, update, or delete policies of\ntype `GDCHRestrictedService`, assign the user or group the `gdchrestrictedservice-policy-manager`\nIAM role.\n\nDefine the scope of an organization policy within a cluster\n-----------------------------------------------------------\n\nWhen defining an organization policy, decide if it should impact all\nnamespaces, only specific namespaces, or all namespaces except a given list. To\nachieve this, use a combination of the `.spec.match.excludedNamespaces`,\n`.spec.match.namespaceSelector`, `.spec.match.namespaces`, and\n`.spec.match.scope` parameters of the policy definition.\n\nRead the\n[organization policy match section](/distributed-cloud/hosted/docs/latest/gdch/apis/policy-match-section) page\nto learn more about these parameters. For example, to allow the creation of\ndatabases only in namespaces that have the label `owner: dba-team`, create the\nfollowing policy: \n\n apiVersion: constraints.gatekeeper.sh/v1beta1\n kind: GDCHRestrictedService\n metadata:\n name: db-restricted-to-dbas\n spec:\n match:\n scope: Namespaced\n namespaceSelector:\n matchExpressions:\n # We are restricting the use of the service in namespaces that\n # don't have the owner: dba-team label\n - key: owner\n operator: NotIn\n values:\n - dba-team\n kinds:\n - apiGroups:\n - \"postgresql.dbadmin.gdc.goog\"\n kinds:\n - DBCluster\n - BackupPlan\n - Import\n - Restore\n - apiGroups:\n - \"oracle.dbadmin.gdc.goog\"\n kinds:\n - DBCluster\n - BackupPlan\n - Import\n parameters:\n disabledOperations:\n - \"UPDATE\"\n - \"CREATE\"\n\nRoll back an existing policy\n----------------------------\n\nTo stop enforcing an existing policy, delete it using the `kubectl` CLI. Use a\nkubeconfig file that gives you access to the cluster where the policy is\ndefined and to the `gdchrestrictedservice-policy-manager` IAM role.\n\nTo delete an organization policy, run: \n\n kubectl --kubeconfig \u003cvar translate=\"no\"\u003eCLUSTER_KUBECONFIG\u003c/var\u003e delete \\\n GDCHRestrictedService/\u003cvar translate=\"no\"\u003ePOLICY_NAME\u003c/var\u003e\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eCLUSTER_KUBECONFIG\u003c/var\u003e: the kubeconfig file of the\n cluster where the organization policy resides.\n\n- \u003cvar translate=\"no\"\u003ePOLICY_NAME\u003c/var\u003e: the name of the organization policy to\n delete.\n\nTest a policy in an audit mode\n------------------------------\n\nYou can test a policy without enforcing it. Test a policy to make sure that\na policy does not break existing systems before rolling it out, or to get an\nestimation of how widespread a behavior is. To add a test, add an\n`enforcementAction` to your policy definition. There are three possible values\nfor this parameter:\n\n- `deny`: the policy is enforced. This is the default setting.\n- `dryrun`: the action is allowed, but you can see that there is a policy violation in both the audit logs and the policy status. Examine the violation with `kubectl --kubeconfig `\u003cvar translate=\"no\"\u003eCLUSTER_KUBECONFIG\u003c/var\u003e` get\n `\u003cvar translate=\"no\"\u003ePOLICY_TYPE\u003c/var\u003e`/`\u003cvar translate=\"no\"\u003ePOLICY_NAME\u003c/var\u003e.\n- `warn`: equivalent to `dryrun` except the test also shows a warning in response to the request that triggered a policy violation.\n\nFor example, to test a policy that disables the Marketplace, create the\nfollowing policy: \n\n apiVersion: constraints.gatekeeper.sh/v1beta1\n kind: GDCHRestrictedService\n metadata:\n name: disable-marketplace-service-project-alice\n Spec:\n enforcementAction: warn\n match:\n kinds:\n - apiGroups: [\"marketplace.gdc.goog\"]\n kinds: [\"MarketplaceService\"]"]]
