Google Cloud Binary Authorization V1 Client - Class AdmissionRule (0.5.13)

Reference documentation and code samples for the Google Cloud Binary Authorization V1 Client class AdmissionRule.

An admission rule specifies either that all container images used in a pod creation request must be attested to by one or more attestors, that all pod creations will be allowed, or that all pod creations will be denied.

Images matching an admission allowlist pattern are exempted from admission rules and will never block a pod creation.

Generated from protobuf message google.cloud.binaryauthorization.v1.AdmissionRule

Namespace

Google \ Cloud \ BinaryAuthorization \ V1

Methods

__construct

Constructor.

Parameters
NameDescription
data array

Optional. Data for populating the Message object.

↳ evaluation_mode int

Required. How this admission rule will be evaluated.

↳ require_attestations_by array

Optional. The resource names of the attestors that must attest to a container image, in the format projects/*/attestors/*. Each attestor must exist before a policy can reference it. To add an attestor to a policy the principal issuing the policy change request must be able to read the attestor resource. Note: this field must be non-empty when the evaluation_mode field specifies REQUIRE_ATTESTATION, otherwise it must be empty.

↳ enforcement_mode int

Required. The action when a pod creation is denied by the admission rule.

getEvaluationMode

Required. How this admission rule will be evaluated.

Returns
TypeDescription
int

setEvaluationMode

Required. How this admission rule will be evaluated.

Parameter
NameDescription
var int
Returns
TypeDescription
$this

getRequireAttestationsBy

Optional. The resource names of the attestors that must attest to a container image, in the format projects/*/attestors/*. Each attestor must exist before a policy can reference it. To add an attestor to a policy the principal issuing the policy change request must be able to read the attestor resource.

Note: this field must be non-empty when the evaluation_mode field specifies REQUIRE_ATTESTATION, otherwise it must be empty.

Returns
TypeDescription
Google\Protobuf\Internal\RepeatedField

setRequireAttestationsBy

Optional. The resource names of the attestors that must attest to a container image, in the format projects/*/attestors/*. Each attestor must exist before a policy can reference it. To add an attestor to a policy the principal issuing the policy change request must be able to read the attestor resource.

Note: this field must be non-empty when the evaluation_mode field specifies REQUIRE_ATTESTATION, otherwise it must be empty.

Parameter
NameDescription
var string[]
Returns
TypeDescription
$this

getEnforcementMode

Required. The action when a pod creation is denied by the admission rule.

Returns
TypeDescription
int

setEnforcementMode

Required. The action when a pod creation is denied by the admission rule.

Parameter
NameDescription
var int
Returns
TypeDescription
$this