Reference documentation and code samples for the Google Cloud Binary Authorization V1 Client class AdmissionRule.
An admission rule specifies either that all container images used in a pod creation request must be attested to by one or more attestors, that all pod creations will be allowed, or that all pod creations will be denied.
Images matching an admission allowlist pattern are exempted from admission rules and will never block a pod creation.
Generated from protobuf message google.cloud.binaryauthorization.v1.AdmissionRule
Namespace
Google \ Cloud \ BinaryAuthorization \ V1Methods
__construct
Constructor.
| Parameters | |
|---|---|
| Name | Description |
data |
array
Optional. Data for populating the Message object. |
↳ evaluation_mode |
int
Required. How this admission rule will be evaluated. |
↳ require_attestations_by |
array
Optional. The resource names of the attestors that must attest to a container image, in the format |
↳ enforcement_mode |
int
Required. The action when a pod creation is denied by the admission rule. |
getEvaluationMode
Required. How this admission rule will be evaluated.
| Returns | |
|---|---|
| Type | Description |
int | |
setEvaluationMode
Required. How this admission rule will be evaluated.
| Parameter | |
|---|---|
| Name | Description |
var |
int
|
| Returns | |
|---|---|
| Type | Description |
$this | |
getRequireAttestationsBy
Optional. The resource names of the attestors that must attest to
a container image, in the format projects/*/attestors/*. Each
attestor must exist before a policy can reference it. To add an attestor
to a policy the principal issuing the policy change request must be able
to read the attestor resource.
Note: this field must be non-empty when the evaluation_mode field specifies REQUIRE_ATTESTATION, otherwise it must be empty.
| Returns | |
|---|---|
| Type | Description |
Google\Protobuf\Internal\RepeatedField | |
setRequireAttestationsBy
Optional. The resource names of the attestors that must attest to
a container image, in the format projects/*/attestors/*. Each
attestor must exist before a policy can reference it. To add an attestor
to a policy the principal issuing the policy change request must be able
to read the attestor resource.
Note: this field must be non-empty when the evaluation_mode field specifies REQUIRE_ATTESTATION, otherwise it must be empty.
| Parameter | |
|---|---|
| Name | Description |
var |
string[]
|
| Returns | |
|---|---|
| Type | Description |
$this | |
getEnforcementMode
Required. The action when a pod creation is denied by the admission rule.
| Returns | |
|---|---|
| Type | Description |
int | |
setEnforcementMode
Required. The action when a pod creation is denied by the admission rule.
| Parameter | |
|---|---|
| Name | Description |
var |
int
|
| Returns | |
|---|---|
| Type | Description |
$this | |