Anadmission rulespecifies either that all container images used in a pod creation request must be attested to by one or moreattestors, that all pod creations will be allowed, or that all pod creations will be denied.
Images matching anadmission allowlist patternare exempted from admission rules and will never block a pod creation.
Required. How this admission rule will be evaluated.
requireAttestationsBy[]
string
Optional. The resource names of the attestors that must attest to a container image, in the formatprojects/*/attestors/*. Each attestor must exist before a policy can reference it. To add an attestor to a policy the principal issuing the policy change request must be able to read the attestor resource.
Note: this field must be non-empty when the evaluationMode field specifies REQUIRE_ATTESTATION, otherwise it must be empty.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-05-30 UTC."],[[["\u003cp\u003eAn admission rule determines if pod creation requests are allowed, denied, or require attestation from specified attestors.\u003c/p\u003e\n"],["\u003cp\u003eImages matching an admission allowlist pattern bypass admission rules and are always allowed for pod creation.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003eevaluationMode\u003c/code\u003e field dictates how the admission rule is assessed.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003erequireAttestationsBy\u003c/code\u003e field lists the attestors required for container image validation, in the format \u003ccode\u003eprojects/*/attestors/*\u003c/code\u003e.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003eenforcementMode\u003c/code\u003e field dictates what happens when pod creation is blocked by the rule.\u003c/p\u003e\n"]]],[],null,["# AdmissionRule\n\n- [JSON representation](#SCHEMA_REPRESENTATION)\n\nAn [admission rule](/binary-authorization/docs/reference/rest/Shared.Types/AdmissionRule) specifies either that all container images used in a pod creation request must be attested to by one or more [attestors](/binary-authorization/docs/reference/rest/Shared.Types/Attestor), that all pod creations will be allowed, or that all pod creations will be denied.\n\nImages matching an [admission allowlist pattern](/binary-authorization/docs/reference/rest/Shared.Types/AdmissionWhitelistPattern) are exempted from admission rules and will never block a pod creation."]]
