Binary Authorization V1 API - Class Google::Cloud::BinaryAuthorization::V1::AdmissionRule (v0.4.0)

Reference documentation and code samples for the Binary Authorization V1 API class Google::Cloud::BinaryAuthorization::V1::AdmissionRule.

An admission rule specifies either that all container images used in a pod creation request must be attested to by one or more attestors, that all pod creations will be allowed, or that all pod creations will be denied.

Images matching an admission allowlist pattern are exempted from admission rules and will never block a pod creation.

Inherits

Object

Extended By

Google::Protobuf::MessageExts::ClassMethods

Includes

Google::Protobuf::MessageExts

Methods

#enforcement_mode

def enforcement_mode() -> ::Google::Cloud::BinaryAuthorization::V1::AdmissionRule::EnforcementMode

Returns

(::Google::Cloud::BinaryAuthorization::V1::AdmissionRule::EnforcementMode) — Required. The action when a pod creation is denied by the admission rule.

#enforcement_mode=

def enforcement_mode=(value) -> ::Google::Cloud::BinaryAuthorization::V1::AdmissionRule::EnforcementMode

Parameter

value (::Google::Cloud::BinaryAuthorization::V1::AdmissionRule::EnforcementMode) — Required. The action when a pod creation is denied by the admission rule.

Returns

(::Google::Cloud::BinaryAuthorization::V1::AdmissionRule::EnforcementMode) — Required. The action when a pod creation is denied by the admission rule.

#evaluation_mode

def evaluation_mode() -> ::Google::Cloud::BinaryAuthorization::V1::AdmissionRule::EvaluationMode

Returns

(::Google::Cloud::BinaryAuthorization::V1::AdmissionRule::EvaluationMode) — Required. How this admission rule will be evaluated.

#evaluation_mode=

def evaluation_mode=(value) -> ::Google::Cloud::BinaryAuthorization::V1::AdmissionRule::EvaluationMode

Parameter

value (::Google::Cloud::BinaryAuthorization::V1::AdmissionRule::EvaluationMode) — Required. How this admission rule will be evaluated.

Returns

(::Google::Cloud::BinaryAuthorization::V1::AdmissionRule::EvaluationMode) — Required. How this admission rule will be evaluated.

#require_attestations_by

def require_attestations_by() -> ::Array<::String>

Returns

(::Array<::String>) — Optional. The resource names of the attestors that must attest to a container image, in the format projects/*/attestors/*. Each attestor must exist before a policy can reference it. To add an attestor to a policy the principal issuing the policy change request must be able to read the attestor resource.

Note: this field must be non-empty when the evaluation_mode field specifies REQUIRE_ATTESTATION, otherwise it must be empty.

#require_attestations_by=

def require_attestations_by=(value) -> ::Array<::String>

Parameter

value (::Array<::String>) — Optional. The resource names of the attestors that must attest to a container image, in the format projects/*/attestors/*. Each attestor must exist before a policy can reference it. To add an attestor to a policy the principal issuing the policy change request must be able to read the attestor resource.

Note: this field must be non-empty when the evaluation_mode field specifies REQUIRE_ATTESTATION, otherwise it must be empty.

Returns

(::Array<::String>) — Optional. The resource names of the attestors that must attest to a container image, in the format projects/*/attestors/*. Each attestor must exist before a policy can reference it. To add an attestor to a policy the principal issuing the policy change request must be able to read the attestor resource.

Note: this field must be non-empty when the evaluation_mode field specifies REQUIRE_ATTESTATION, otherwise it must be empty.