Reference documentation and code samples for the Google Cloud Binary Authorization V1 Client class AdmissionRule.
An admission rule specifies either that all container images used in a pod creation request must be attested to by one or more attestors , that all pod creations will be allowed, or that all pod creations will be denied.
Images matching an admission allowlist pattern are exempted from admission rules and will never block a pod creation.
Generated from protobuf message google.cloud.binaryauthorization.v1.AdmissionRule
Namespace
Google \ Cloud \ BinaryAuthorization \ V1Methods
__construct
Constructor.
data
array
Optional. Data for populating the Message object.
↳ evaluation_mode
int
Required. How this admission rule will be evaluated.
↳ require_attestations_by
array
Optional. The resource names of the attestors that must attest to a container image, in the format projects/*/attestors/*
. Each attestor must exist before a policy can reference it. To add an attestor to a policy the principal issuing the policy change request must be able to read the attestor resource. Note: this field must be non-empty when the evaluation_mode field specifies REQUIRE_ATTESTATION, otherwise it must be empty.
↳ enforcement_mode
int
Required. The action when a pod creation is denied by the admission rule.
getEvaluationMode
Required. How this admission rule will be evaluated.
int
setEvaluationMode
Required. How this admission rule will be evaluated.
var
int
$this
getRequireAttestationsBy
Optional. The resource names of the attestors that must attest to
a container image, in the format projects/*/attestors/*
. Each
attestor must exist before a policy can reference it. To add an attestor
to a policy the principal issuing the policy change request must be able
to read the attestor resource.
Note: this field must be non-empty when the evaluation_mode field specifies REQUIRE_ATTESTATION, otherwise it must be empty.
setRequireAttestationsBy
Optional. The resource names of the attestors that must attest to
a container image, in the format projects/*/attestors/*
. Each
attestor must exist before a policy can reference it. To add an attestor
to a policy the principal issuing the policy change request must be able
to read the attestor resource.
Note: this field must be non-empty when the evaluation_mode field specifies REQUIRE_ATTESTATION, otherwise it must be empty.
var
string[]
$this
getEnforcementMode
Required. The action when a pod creation is denied by the admission rule.
int
setEnforcementMode
Required. The action when a pod creation is denied by the admission rule.
var
int
$this
