google-cloud-binary_authorization-v1beta1 0.3.5 → 0.4.0
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/lib/google/cloud/binary_authorization/v1beta1/binauthz_management_service/client.rb +37 -65
- data/lib/google/cloud/binary_authorization/v1beta1/binauthz_management_service/paths.rb +24 -5
- data/lib/google/cloud/binary_authorization/v1beta1/system_policy/client.rb +388 -0
- data/lib/google/cloud/binary_authorization/v1beta1/system_policy/credentials.rb +51 -0
- data/lib/google/cloud/binary_authorization/v1beta1/system_policy/paths.rb +66 -0
- data/lib/google/cloud/binary_authorization/v1beta1/system_policy.rb +49 -0
- data/lib/google/cloud/binary_authorization/v1beta1/version.rb +1 -1
- data/lib/google/cloud/binary_authorization/v1beta1.rb +1 -0
- data/lib/google/cloud/binaryauthorization/v1beta1/resources_pb.rb +7 -1
- data/lib/google/cloud/binaryauthorization/v1beta1/service_pb.rb +4 -0
- data/lib/google/cloud/binaryauthorization/v1beta1/service_services_pb.rb +34 -33
- data/proto_docs/google/cloud/binaryauthorization/v1beta1/resources.rb +73 -25
- data/proto_docs/google/cloud/binaryauthorization/v1beta1/service.rb +32 -37
- metadata +6 -2
|
@@ -0,0 +1,51 @@
|
|
|
1
|
+
# frozen_string_literal: true
|
|
2
|
+
|
|
3
|
+
# Copyright 2021 Google LLC
|
|
4
|
+
#
|
|
5
|
+
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
6
|
+
# you may not use this file except in compliance with the License.
|
|
7
|
+
# You may obtain a copy of the License at
|
|
8
|
+
#
|
|
9
|
+
# https://www.apache.org/licenses/LICENSE-2.0
|
|
10
|
+
#
|
|
11
|
+
# Unless required by applicable law or agreed to in writing, software
|
|
12
|
+
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
13
|
+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
14
|
+
# See the License for the specific language governing permissions and
|
|
15
|
+
# limitations under the License.
|
|
16
|
+
|
|
17
|
+
# Auto-generated by gapic-generator-ruby. DO NOT EDIT!
|
|
18
|
+
|
|
19
|
+
require "googleauth"
|
|
20
|
+
|
|
21
|
+
module Google
|
|
22
|
+
module Cloud
|
|
23
|
+
module BinaryAuthorization
|
|
24
|
+
module V1beta1
|
|
25
|
+
module SystemPolicy
|
|
26
|
+
# Credentials for the SystemPolicy API.
|
|
27
|
+
class Credentials < ::Google::Auth::Credentials
|
|
28
|
+
self.scope = [
|
|
29
|
+
"https://www.googleapis.com/auth/cloud-platform"
|
|
30
|
+
]
|
|
31
|
+
self.env_vars = [
|
|
32
|
+
"BINARY_AUTHORIZATION_CREDENTIALS",
|
|
33
|
+
"BINARY_AUTHORIZATION_KEYFILE",
|
|
34
|
+
"GOOGLE_CLOUD_CREDENTIALS",
|
|
35
|
+
"GOOGLE_CLOUD_KEYFILE",
|
|
36
|
+
"GCLOUD_KEYFILE",
|
|
37
|
+
"BINARY_AUTHORIZATION_CREDENTIALS_JSON",
|
|
38
|
+
"BINARY_AUTHORIZATION_KEYFILE_JSON",
|
|
39
|
+
"GOOGLE_CLOUD_CREDENTIALS_JSON",
|
|
40
|
+
"GOOGLE_CLOUD_KEYFILE_JSON",
|
|
41
|
+
"GCLOUD_KEYFILE_JSON"
|
|
42
|
+
]
|
|
43
|
+
self.paths = [
|
|
44
|
+
"~/.config/google_cloud/application_default_credentials.json"
|
|
45
|
+
]
|
|
46
|
+
end
|
|
47
|
+
end
|
|
48
|
+
end
|
|
49
|
+
end
|
|
50
|
+
end
|
|
51
|
+
end
|
|
@@ -0,0 +1,66 @@
|
|
|
1
|
+
# frozen_string_literal: true
|
|
2
|
+
|
|
3
|
+
# Copyright 2021 Google LLC
|
|
4
|
+
#
|
|
5
|
+
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
6
|
+
# you may not use this file except in compliance with the License.
|
|
7
|
+
# You may obtain a copy of the License at
|
|
8
|
+
#
|
|
9
|
+
# https://www.apache.org/licenses/LICENSE-2.0
|
|
10
|
+
#
|
|
11
|
+
# Unless required by applicable law or agreed to in writing, software
|
|
12
|
+
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
13
|
+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
14
|
+
# See the License for the specific language governing permissions and
|
|
15
|
+
# limitations under the License.
|
|
16
|
+
|
|
17
|
+
# Auto-generated by gapic-generator-ruby. DO NOT EDIT!
|
|
18
|
+
|
|
19
|
+
|
|
20
|
+
module Google
|
|
21
|
+
module Cloud
|
|
22
|
+
module BinaryAuthorization
|
|
23
|
+
module V1beta1
|
|
24
|
+
module SystemPolicy
|
|
25
|
+
# Path helper methods for the SystemPolicy API.
|
|
26
|
+
module Paths
|
|
27
|
+
##
|
|
28
|
+
# Create a fully-qualified Policy resource string.
|
|
29
|
+
#
|
|
30
|
+
# @overload policy_path(project:)
|
|
31
|
+
# The resource will be in the following format:
|
|
32
|
+
#
|
|
33
|
+
# `projects/{project}/policy`
|
|
34
|
+
#
|
|
35
|
+
# @param project [String]
|
|
36
|
+
#
|
|
37
|
+
# @overload policy_path(location:)
|
|
38
|
+
# The resource will be in the following format:
|
|
39
|
+
#
|
|
40
|
+
# `locations/{location}/policy`
|
|
41
|
+
#
|
|
42
|
+
# @param location [String]
|
|
43
|
+
#
|
|
44
|
+
# @return [::String]
|
|
45
|
+
def policy_path **args
|
|
46
|
+
resources = {
|
|
47
|
+
"project" => (proc do |project:|
|
|
48
|
+
"projects/#{project}/policy"
|
|
49
|
+
end),
|
|
50
|
+
"location" => (proc do |location:|
|
|
51
|
+
"locations/#{location}/policy"
|
|
52
|
+
end)
|
|
53
|
+
}
|
|
54
|
+
|
|
55
|
+
resource = resources[args.keys.sort.join(":")]
|
|
56
|
+
raise ::ArgumentError, "no resource found for values #{args.keys}" if resource.nil?
|
|
57
|
+
resource.call(**args)
|
|
58
|
+
end
|
|
59
|
+
|
|
60
|
+
extend self
|
|
61
|
+
end
|
|
62
|
+
end
|
|
63
|
+
end
|
|
64
|
+
end
|
|
65
|
+
end
|
|
66
|
+
end
|
|
@@ -0,0 +1,49 @@
|
|
|
1
|
+
# frozen_string_literal: true
|
|
2
|
+
|
|
3
|
+
# Copyright 2021 Google LLC
|
|
4
|
+
#
|
|
5
|
+
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
6
|
+
# you may not use this file except in compliance with the License.
|
|
7
|
+
# You may obtain a copy of the License at
|
|
8
|
+
#
|
|
9
|
+
# https://www.apache.org/licenses/LICENSE-2.0
|
|
10
|
+
#
|
|
11
|
+
# Unless required by applicable law or agreed to in writing, software
|
|
12
|
+
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
13
|
+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
14
|
+
# See the License for the specific language governing permissions and
|
|
15
|
+
# limitations under the License.
|
|
16
|
+
|
|
17
|
+
# Auto-generated by gapic-generator-ruby. DO NOT EDIT!
|
|
18
|
+
|
|
19
|
+
require "gapic/common"
|
|
20
|
+
require "gapic/config"
|
|
21
|
+
require "gapic/config/method"
|
|
22
|
+
|
|
23
|
+
require "google/cloud/binary_authorization/v1beta1/version"
|
|
24
|
+
|
|
25
|
+
require "google/cloud/binary_authorization/v1beta1/system_policy/credentials"
|
|
26
|
+
require "google/cloud/binary_authorization/v1beta1/system_policy/paths"
|
|
27
|
+
require "google/cloud/binary_authorization/v1beta1/system_policy/client"
|
|
28
|
+
|
|
29
|
+
module Google
|
|
30
|
+
module Cloud
|
|
31
|
+
module BinaryAuthorization
|
|
32
|
+
module V1beta1
|
|
33
|
+
##
|
|
34
|
+
# API for working with the system policy.
|
|
35
|
+
#
|
|
36
|
+
# To load this service and instantiate a client:
|
|
37
|
+
#
|
|
38
|
+
# require "google/cloud/binary_authorization/v1beta1/system_policy"
|
|
39
|
+
# client = ::Google::Cloud::BinaryAuthorization::V1beta1::SystemPolicy::Client.new
|
|
40
|
+
#
|
|
41
|
+
module SystemPolicy
|
|
42
|
+
end
|
|
43
|
+
end
|
|
44
|
+
end
|
|
45
|
+
end
|
|
46
|
+
end
|
|
47
|
+
|
|
48
|
+
helper_path = ::File.join __dir__, "system_policy", "helpers.rb"
|
|
49
|
+
require "google/cloud/binary_authorization/v1beta1/system_policy/helpers" if ::File.file? helper_path
|
|
@@ -17,6 +17,7 @@
|
|
|
17
17
|
# Auto-generated by gapic-generator-ruby. DO NOT EDIT!
|
|
18
18
|
|
|
19
19
|
require "google/cloud/binary_authorization/v1beta1/binauthz_management_service"
|
|
20
|
+
require "google/cloud/binary_authorization/v1beta1/system_policy"
|
|
20
21
|
require "google/cloud/binary_authorization/v1beta1/version"
|
|
21
22
|
|
|
22
23
|
module Google
|
|
@@ -1,10 +1,10 @@
|
|
|
1
1
|
# Generated by the protocol buffer compiler. DO NOT EDIT!
|
|
2
2
|
# source: google/cloud/binaryauthorization/v1beta1/resources.proto
|
|
3
3
|
|
|
4
|
-
require 'google/api/annotations_pb'
|
|
5
4
|
require 'google/api/field_behavior_pb'
|
|
6
5
|
require 'google/api/resource_pb'
|
|
7
6
|
require 'google/protobuf/timestamp_pb'
|
|
7
|
+
require 'google/api/annotations_pb'
|
|
8
8
|
require 'google/protobuf'
|
|
9
9
|
|
|
10
10
|
Google::Protobuf::DescriptorPool.generated_pool.build do
|
|
@@ -15,6 +15,9 @@ Google::Protobuf::DescriptorPool.generated_pool.build do
|
|
|
15
15
|
optional :global_policy_evaluation_mode, :enum, 7, "google.cloud.binaryauthorization.v1beta1.Policy.GlobalPolicyEvaluationMode"
|
|
16
16
|
repeated :admission_whitelist_patterns, :message, 2, "google.cloud.binaryauthorization.v1beta1.AdmissionWhitelistPattern"
|
|
17
17
|
map :cluster_admission_rules, :string, :message, 3, "google.cloud.binaryauthorization.v1beta1.AdmissionRule"
|
|
18
|
+
map :kubernetes_namespace_admission_rules, :string, :message, 10, "google.cloud.binaryauthorization.v1beta1.AdmissionRule"
|
|
19
|
+
map :kubernetes_service_account_admission_rules, :string, :message, 8, "google.cloud.binaryauthorization.v1beta1.AdmissionRule"
|
|
20
|
+
map :istio_service_identity_admission_rules, :string, :message, 9, "google.cloud.binaryauthorization.v1beta1.AdmissionRule"
|
|
18
21
|
optional :default_admission_rule, :message, 4, "google.cloud.binaryauthorization.v1beta1.AdmissionRule"
|
|
19
22
|
optional :update_time, :message, 5, "google.protobuf.Timestamp"
|
|
20
23
|
end
|
|
@@ -70,8 +73,11 @@ Google::Protobuf::DescriptorPool.generated_pool.build do
|
|
|
70
73
|
value :RSA_SIGN_PKCS1_4096_SHA256, 7
|
|
71
74
|
value :RSA_SIGN_PKCS1_4096_SHA512, 8
|
|
72
75
|
value :ECDSA_P256_SHA256, 9
|
|
76
|
+
value :EC_SIGN_P256_SHA256, 9
|
|
73
77
|
value :ECDSA_P384_SHA384, 10
|
|
78
|
+
value :EC_SIGN_P384_SHA384, 10
|
|
74
79
|
value :ECDSA_P521_SHA512, 11
|
|
80
|
+
value :EC_SIGN_P521_SHA512, 11
|
|
75
81
|
end
|
|
76
82
|
add_message "google.cloud.binaryauthorization.v1beta1.AttestorPublicKey" do
|
|
77
83
|
optional :comment, :string, 1
|
|
@@ -40,6 +40,9 @@ Google::Protobuf::DescriptorPool.generated_pool.build do
|
|
|
40
40
|
add_message "google.cloud.binaryauthorization.v1beta1.DeleteAttestorRequest" do
|
|
41
41
|
optional :name, :string, 1
|
|
42
42
|
end
|
|
43
|
+
add_message "google.cloud.binaryauthorization.v1beta1.GetSystemPolicyRequest" do
|
|
44
|
+
optional :name, :string, 1
|
|
45
|
+
end
|
|
43
46
|
end
|
|
44
47
|
end
|
|
45
48
|
|
|
@@ -55,6 +58,7 @@ module Google
|
|
|
55
58
|
ListAttestorsRequest = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("google.cloud.binaryauthorization.v1beta1.ListAttestorsRequest").msgclass
|
|
56
59
|
ListAttestorsResponse = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("google.cloud.binaryauthorization.v1beta1.ListAttestorsResponse").msgclass
|
|
57
60
|
DeleteAttestorRequest = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("google.cloud.binaryauthorization.v1beta1.DeleteAttestorRequest").msgclass
|
|
61
|
+
GetSystemPolicyRequest = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("google.cloud.binaryauthorization.v1beta1.GetSystemPolicyRequest").msgclass
|
|
58
62
|
end
|
|
59
63
|
end
|
|
60
64
|
end
|
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
# Generated by the protocol buffer compiler. DO NOT EDIT!
|
|
2
2
|
# Source: google/cloud/binaryauthorization/v1beta1/service.proto for package 'Google.Cloud.BinaryAuthorization.V1beta1'
|
|
3
3
|
# Original file comments:
|
|
4
|
-
# Copyright
|
|
4
|
+
# Copyright 2021 Google LLC
|
|
5
5
|
#
|
|
6
6
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
7
7
|
# you may not use this file except in compliance with the License.
|
|
@@ -15,7 +15,6 @@
|
|
|
15
15
|
# See the License for the specific language governing permissions and
|
|
16
16
|
# limitations under the License.
|
|
17
17
|
#
|
|
18
|
-
#
|
|
19
18
|
|
|
20
19
|
require 'grpc'
|
|
21
20
|
require 'google/cloud/binaryauthorization/v1beta1/service_pb'
|
|
@@ -42,53 +41,55 @@ module Google
|
|
|
42
41
|
self.unmarshal_class_method = :decode
|
|
43
42
|
self.service_name = 'google.cloud.binaryauthorization.v1beta1.BinauthzManagementServiceV1Beta1'
|
|
44
43
|
|
|
45
|
-
# A [policy][google.cloud.binaryauthorization.v1beta1.Policy] specifies the
|
|
46
|
-
#
|
|
47
|
-
# attest to a container image, before the project is allowed to deploy that
|
|
44
|
+
# A [policy][google.cloud.binaryauthorization.v1beta1.Policy] specifies the [attestors][google.cloud.binaryauthorization.v1beta1.Attestor] that must attest to
|
|
45
|
+
# a container image, before the project is allowed to deploy that
|
|
48
46
|
# image. There is at most one policy per project. All image admission
|
|
49
47
|
# requests are permitted if a project has no policy.
|
|
50
48
|
#
|
|
51
|
-
# Gets the [policy][google.cloud.binaryauthorization.v1beta1.Policy] for this
|
|
52
|
-
#
|
|
53
|
-
# [policy][google.cloud.binaryauthorization.v1beta1.Policy] if the project
|
|
54
|
-
# does not have one.
|
|
49
|
+
# Gets the [policy][google.cloud.binaryauthorization.v1beta1.Policy] for this project. Returns a default
|
|
50
|
+
# [policy][google.cloud.binaryauthorization.v1beta1.Policy] if the project does not have one.
|
|
55
51
|
rpc :GetPolicy, ::Google::Cloud::BinaryAuthorization::V1beta1::GetPolicyRequest, ::Google::Cloud::BinaryAuthorization::V1beta1::Policy
|
|
56
|
-
# Creates or updates a project's
|
|
57
|
-
# [policy][google.cloud.binaryauthorization.v1beta1.Policy],
|
|
58
|
-
#
|
|
59
|
-
#
|
|
60
|
-
#
|
|
61
|
-
# if the project does not exist, INVALID_ARGUMENT if the request is
|
|
62
|
-
# malformed.
|
|
52
|
+
# Creates or updates a project's [policy][google.cloud.binaryauthorization.v1beta1.Policy], and returns a copy of the
|
|
53
|
+
# new [policy][google.cloud.binaryauthorization.v1beta1.Policy]. A policy is always updated as a whole, to avoid race
|
|
54
|
+
# conditions with concurrent policy enforcement (or management!)
|
|
55
|
+
# requests. Returns NOT_FOUND if the project does not exist, INVALID_ARGUMENT
|
|
56
|
+
# if the request is malformed.
|
|
63
57
|
rpc :UpdatePolicy, ::Google::Cloud::BinaryAuthorization::V1beta1::UpdatePolicyRequest, ::Google::Cloud::BinaryAuthorization::V1beta1::Policy
|
|
64
|
-
# Creates an [attestor][google.cloud.binaryauthorization.v1beta1.Attestor],
|
|
65
|
-
#
|
|
66
|
-
#
|
|
67
|
-
#
|
|
68
|
-
# malformed, ALREADY_EXISTS if the
|
|
69
|
-
# [attestor][google.cloud.binaryauthorization.v1beta1.Attestor] already
|
|
70
|
-
# exists.
|
|
58
|
+
# Creates an [attestor][google.cloud.binaryauthorization.v1beta1.Attestor], and returns a copy of the new
|
|
59
|
+
# [attestor][google.cloud.binaryauthorization.v1beta1.Attestor]. Returns NOT_FOUND if the project does not exist,
|
|
60
|
+
# INVALID_ARGUMENT if the request is malformed, ALREADY_EXISTS if the
|
|
61
|
+
# [attestor][google.cloud.binaryauthorization.v1beta1.Attestor] already exists.
|
|
71
62
|
rpc :CreateAttestor, ::Google::Cloud::BinaryAuthorization::V1beta1::CreateAttestorRequest, ::Google::Cloud::BinaryAuthorization::V1beta1::Attestor
|
|
72
63
|
# Gets an [attestor][google.cloud.binaryauthorization.v1beta1.Attestor].
|
|
73
|
-
# Returns NOT_FOUND if the
|
|
74
|
-
# [attestor][google.cloud.binaryauthorization.v1beta1.Attestor] does not
|
|
75
|
-
# exist.
|
|
64
|
+
# Returns NOT_FOUND if the [attestor][google.cloud.binaryauthorization.v1beta1.Attestor] does not exist.
|
|
76
65
|
rpc :GetAttestor, ::Google::Cloud::BinaryAuthorization::V1beta1::GetAttestorRequest, ::Google::Cloud::BinaryAuthorization::V1beta1::Attestor
|
|
77
66
|
# Updates an [attestor][google.cloud.binaryauthorization.v1beta1.Attestor].
|
|
78
|
-
# Returns NOT_FOUND if the
|
|
79
|
-
# [attestor][google.cloud.binaryauthorization.v1beta1.Attestor] does not
|
|
80
|
-
# exist.
|
|
67
|
+
# Returns NOT_FOUND if the [attestor][google.cloud.binaryauthorization.v1beta1.Attestor] does not exist.
|
|
81
68
|
rpc :UpdateAttestor, ::Google::Cloud::BinaryAuthorization::V1beta1::UpdateAttestorRequest, ::Google::Cloud::BinaryAuthorization::V1beta1::Attestor
|
|
82
69
|
# Lists [attestors][google.cloud.binaryauthorization.v1beta1.Attestor].
|
|
83
70
|
# Returns INVALID_ARGUMENT if the project does not exist.
|
|
84
71
|
rpc :ListAttestors, ::Google::Cloud::BinaryAuthorization::V1beta1::ListAttestorsRequest, ::Google::Cloud::BinaryAuthorization::V1beta1::ListAttestorsResponse
|
|
85
|
-
# Deletes an [attestor][google.cloud.binaryauthorization.v1beta1.Attestor].
|
|
86
|
-
#
|
|
87
|
-
# [attestor][google.cloud.binaryauthorization.v1beta1.Attestor] does not
|
|
88
|
-
# exist.
|
|
72
|
+
# Deletes an [attestor][google.cloud.binaryauthorization.v1beta1.Attestor]. Returns NOT_FOUND if the
|
|
73
|
+
# [attestor][google.cloud.binaryauthorization.v1beta1.Attestor] does not exist.
|
|
89
74
|
rpc :DeleteAttestor, ::Google::Cloud::BinaryAuthorization::V1beta1::DeleteAttestorRequest, ::Google::Protobuf::Empty
|
|
90
75
|
end
|
|
91
76
|
|
|
77
|
+
Stub = Service.rpc_stub_class
|
|
78
|
+
end
|
|
79
|
+
module SystemPolicyV1Beta1
|
|
80
|
+
# API for working with the system policy.
|
|
81
|
+
class Service
|
|
82
|
+
|
|
83
|
+
include ::GRPC::GenericService
|
|
84
|
+
|
|
85
|
+
self.marshal_class_method = :encode
|
|
86
|
+
self.unmarshal_class_method = :decode
|
|
87
|
+
self.service_name = 'google.cloud.binaryauthorization.v1beta1.SystemPolicyV1Beta1'
|
|
88
|
+
|
|
89
|
+
# Gets the current system policy in the specified location.
|
|
90
|
+
rpc :GetSystemPolicy, ::Google::Cloud::BinaryAuthorization::V1beta1::GetSystemPolicyRequest, ::Google::Cloud::BinaryAuthorization::V1beta1::Policy
|
|
91
|
+
end
|
|
92
|
+
|
|
92
93
|
Stub = Service.rpc_stub_class
|
|
93
94
|
end
|
|
94
95
|
end
|
|
@@ -21,8 +21,7 @@ module Google
|
|
|
21
21
|
module Cloud
|
|
22
22
|
module BinaryAuthorization
|
|
23
23
|
module V1beta1
|
|
24
|
-
# A {::Google::Cloud::BinaryAuthorization::V1beta1::Policy policy} for
|
|
25
|
-
# image binary authorization.
|
|
24
|
+
# A {::Google::Cloud::BinaryAuthorization::V1beta1::Policy policy} for Binary Authorization.
|
|
26
25
|
# @!attribute [r] name
|
|
27
26
|
# @return [::String]
|
|
28
27
|
# Output only. The resource name, in the format `projects/*/policy`. There is
|
|
@@ -50,6 +49,21 @@ module Google
|
|
|
50
49
|
# (e.g. us-central1).
|
|
51
50
|
# For `clusterId` syntax restrictions see
|
|
52
51
|
# https://cloud.google.com/container-engine/reference/rest/v1/projects.zones.clusters.
|
|
52
|
+
# @!attribute [rw] kubernetes_namespace_admission_rules
|
|
53
|
+
# @return [::Google::Protobuf::Map{::String => ::Google::Cloud::BinaryAuthorization::V1beta1::AdmissionRule}]
|
|
54
|
+
# Optional. Per-kubernetes-namespace admission rules. K8s namespace spec format:
|
|
55
|
+
# `[a-z.-]+`, e.g. `some-namespace`
|
|
56
|
+
# @!attribute [rw] kubernetes_service_account_admission_rules
|
|
57
|
+
# @return [::Google::Protobuf::Map{::String => ::Google::Cloud::BinaryAuthorization::V1beta1::AdmissionRule}]
|
|
58
|
+
# Optional. Per-kubernetes-service-account admission rules. Service account
|
|
59
|
+
# spec format: `namespace:serviceaccount`. e.g. `test-ns:default`
|
|
60
|
+
# @!attribute [rw] istio_service_identity_admission_rules
|
|
61
|
+
# @return [::Google::Protobuf::Map{::String => ::Google::Cloud::BinaryAuthorization::V1beta1::AdmissionRule}]
|
|
62
|
+
# Optional. Per-istio-service-identity admission rules. Istio service
|
|
63
|
+
# identity spec format:
|
|
64
|
+
# `spiffe://<domain>/ns/<namespace>/sa/<serviceaccount>` or
|
|
65
|
+
# `<domain>/ns/<namespace>/sa/<serviceaccount>`
|
|
66
|
+
# e.g. `spiffe://example.com/ns/test-ns/sa/default`
|
|
53
67
|
# @!attribute [rw] default_admission_rule
|
|
54
68
|
# @return [::Google::Cloud::BinaryAuthorization::V1beta1::AdmissionRule]
|
|
55
69
|
# Required. Default admission rule for a cluster without a per-cluster, per-
|
|
@@ -70,6 +84,33 @@ module Google
|
|
|
70
84
|
extend ::Google::Protobuf::MessageExts::ClassMethods
|
|
71
85
|
end
|
|
72
86
|
|
|
87
|
+
# @!attribute [rw] key
|
|
88
|
+
# @return [::String]
|
|
89
|
+
# @!attribute [rw] value
|
|
90
|
+
# @return [::Google::Cloud::BinaryAuthorization::V1beta1::AdmissionRule]
|
|
91
|
+
class KubernetesNamespaceAdmissionRulesEntry
|
|
92
|
+
include ::Google::Protobuf::MessageExts
|
|
93
|
+
extend ::Google::Protobuf::MessageExts::ClassMethods
|
|
94
|
+
end
|
|
95
|
+
|
|
96
|
+
# @!attribute [rw] key
|
|
97
|
+
# @return [::String]
|
|
98
|
+
# @!attribute [rw] value
|
|
99
|
+
# @return [::Google::Cloud::BinaryAuthorization::V1beta1::AdmissionRule]
|
|
100
|
+
class KubernetesServiceAccountAdmissionRulesEntry
|
|
101
|
+
include ::Google::Protobuf::MessageExts
|
|
102
|
+
extend ::Google::Protobuf::MessageExts::ClassMethods
|
|
103
|
+
end
|
|
104
|
+
|
|
105
|
+
# @!attribute [rw] key
|
|
106
|
+
# @return [::String]
|
|
107
|
+
# @!attribute [rw] value
|
|
108
|
+
# @return [::Google::Cloud::BinaryAuthorization::V1beta1::AdmissionRule]
|
|
109
|
+
class IstioServiceIdentityAdmissionRulesEntry
|
|
110
|
+
include ::Google::Protobuf::MessageExts
|
|
111
|
+
extend ::Google::Protobuf::MessageExts::ClassMethods
|
|
112
|
+
end
|
|
113
|
+
|
|
73
114
|
module GlobalPolicyEvaluationMode
|
|
74
115
|
# Not specified: DISABLE is assumed.
|
|
75
116
|
GLOBAL_POLICY_EVALUATION_MODE_UNSPECIFIED = 0
|
|
@@ -82,28 +123,28 @@ module Google
|
|
|
82
123
|
end
|
|
83
124
|
end
|
|
84
125
|
|
|
85
|
-
# An
|
|
86
|
-
#
|
|
87
|
-
# exempts images from checks by [admission
|
|
88
|
-
# rules][google.cloud.binaryauthorization.v1beta1.AdmissionRule].
|
|
126
|
+
# An {::Google::Cloud::BinaryAuthorization::V1beta1::AdmissionWhitelistPattern admission allowlist pattern} exempts images
|
|
127
|
+
# from checks by {::Google::Cloud::BinaryAuthorization::V1beta1::AdmissionRule admission rules}.
|
|
89
128
|
# @!attribute [rw] name_pattern
|
|
90
129
|
# @return [::String]
|
|
91
|
-
# An image name pattern to
|
|
130
|
+
# An image name pattern to allowlist, in the form `registry/path/to/image`.
|
|
92
131
|
# This supports a trailing `*` as a wildcard, but this is allowed only in
|
|
93
|
-
# text after the `registry/` part.
|
|
132
|
+
# text after the `registry/` part. `*` wildcard does not match `/`, i.e.,
|
|
133
|
+
# `gcr.io/nginx*` matches `gcr.io/nginx@latest`, but it does not match
|
|
134
|
+
# `gcr.io/nginx/image`. This also supports a trailing `**` wildcard which
|
|
135
|
+
# matches subdirectories, i.e., `gcr.io/nginx**` matches
|
|
136
|
+
# `gcr.io/nginx/image`.
|
|
94
137
|
class AdmissionWhitelistPattern
|
|
95
138
|
include ::Google::Protobuf::MessageExts
|
|
96
139
|
extend ::Google::Protobuf::MessageExts::ClassMethods
|
|
97
140
|
end
|
|
98
141
|
|
|
99
|
-
# An {::Google::Cloud::BinaryAuthorization::V1beta1::AdmissionRule admission rule}
|
|
100
|
-
#
|
|
101
|
-
#
|
|
102
|
-
#
|
|
103
|
-
# creations will be allowed, or that all pod creations will be denied.
|
|
142
|
+
# An {::Google::Cloud::BinaryAuthorization::V1beta1::AdmissionRule admission rule} specifies either that all container images
|
|
143
|
+
# used in a pod creation request must be attested to by one or more
|
|
144
|
+
# {::Google::Cloud::BinaryAuthorization::V1beta1::Attestor attestors}, that all pod creations will be allowed, or that all
|
|
145
|
+
# pod creations will be denied.
|
|
104
146
|
#
|
|
105
|
-
# Images matching an
|
|
106
|
-
# pattern][google.cloud.binaryauthorization.v1beta1.AdmissionWhitelistPattern]
|
|
147
|
+
# Images matching an {::Google::Cloud::BinaryAuthorization::V1beta1::AdmissionWhitelistPattern admission allowlist pattern}
|
|
107
148
|
# are exempted from admission rules and will never block a pod creation.
|
|
108
149
|
# @!attribute [rw] evaluation_mode
|
|
109
150
|
# @return [::Google::Cloud::BinaryAuthorization::V1beta1::AdmissionRule::EvaluationMode]
|
|
@@ -133,7 +174,7 @@ module Google
|
|
|
133
174
|
ALWAYS_ALLOW = 1
|
|
134
175
|
|
|
135
176
|
# This rule allows a pod creation if all the attestors listed in
|
|
136
|
-
#
|
|
177
|
+
# `require_attestations_by` have valid attestations for all of the
|
|
137
178
|
# images in the pod spec.
|
|
138
179
|
REQUIRE_ATTESTATION = 2
|
|
139
180
|
|
|
@@ -156,9 +197,9 @@ module Google
|
|
|
156
197
|
end
|
|
157
198
|
end
|
|
158
199
|
|
|
159
|
-
# An {::Google::Cloud::BinaryAuthorization::V1beta1::Attestor attestor} that attests
|
|
160
|
-
#
|
|
161
|
-
#
|
|
200
|
+
# An {::Google::Cloud::BinaryAuthorization::V1beta1::Attestor attestor} that attests to container image
|
|
201
|
+
# artifacts. An existing attestor cannot be modified except where
|
|
202
|
+
# indicated.
|
|
162
203
|
# @!attribute [rw] name
|
|
163
204
|
# @return [::String]
|
|
164
205
|
# Required. The resource name, in the format:
|
|
@@ -178,9 +219,8 @@ module Google
|
|
|
178
219
|
extend ::Google::Protobuf::MessageExts::ClassMethods
|
|
179
220
|
end
|
|
180
221
|
|
|
181
|
-
# An
|
|
182
|
-
#
|
|
183
|
-
# references a Drydock ATTESTATION_AUTHORITY Note created by the user.
|
|
222
|
+
# An {::Google::Cloud::BinaryAuthorization::V1beta1::UserOwnedDrydockNote user owned drydock note} references a Drydock
|
|
223
|
+
# ATTESTATION_AUTHORITY Note created by the user.
|
|
184
224
|
# @!attribute [rw] note_reference
|
|
185
225
|
# @return [::String]
|
|
186
226
|
# Required. The Drydock resource name of a ATTESTATION_AUTHORITY Note,
|
|
@@ -273,17 +313,25 @@ module Google
|
|
|
273
313
|
# ECDSA on the NIST P-256 curve with a SHA256 digest.
|
|
274
314
|
ECDSA_P256_SHA256 = 9
|
|
275
315
|
|
|
316
|
+
# ECDSA on the NIST P-256 curve with a SHA256 digest.
|
|
317
|
+
EC_SIGN_P256_SHA256 = 9
|
|
318
|
+
|
|
276
319
|
# ECDSA on the NIST P-384 curve with a SHA384 digest.
|
|
277
320
|
ECDSA_P384_SHA384 = 10
|
|
278
321
|
|
|
322
|
+
# ECDSA on the NIST P-384 curve with a SHA384 digest.
|
|
323
|
+
EC_SIGN_P384_SHA384 = 10
|
|
324
|
+
|
|
279
325
|
# ECDSA on the NIST P-521 curve with a SHA512 digest.
|
|
280
326
|
ECDSA_P521_SHA512 = 11
|
|
327
|
+
|
|
328
|
+
# ECDSA on the NIST P-521 curve with a SHA512 digest.
|
|
329
|
+
EC_SIGN_P521_SHA512 = 11
|
|
281
330
|
end
|
|
282
331
|
end
|
|
283
332
|
|
|
284
|
-
# An
|
|
285
|
-
#
|
|
286
|
-
# used to verify attestations signed by this attestor.
|
|
333
|
+
# An {::Google::Cloud::BinaryAuthorization::V1beta1::AttestorPublicKey attestor public key} that will be used to verify
|
|
334
|
+
# attestations signed by this attestor.
|
|
287
335
|
# @!attribute [rw] comment
|
|
288
336
|
# @return [::String]
|
|
289
337
|
# Optional. A descriptive comment. This field may be updated.
|
|
@@ -24,9 +24,8 @@ module Google
|
|
|
24
24
|
# Request message for [BinauthzManagementService.GetPolicy][].
|
|
25
25
|
# @!attribute [rw] name
|
|
26
26
|
# @return [::String]
|
|
27
|
-
# Required. The resource name of the
|
|
28
|
-
#
|
|
29
|
-
# the format `projects/*/policy`.
|
|
27
|
+
# Required. The resource name of the {::Google::Cloud::BinaryAuthorization::V1beta1::Policy policy} to retrieve,
|
|
28
|
+
# in the format `projects/*/policy`.
|
|
30
29
|
class GetPolicyRequest
|
|
31
30
|
include ::Google::Protobuf::MessageExts
|
|
32
31
|
extend ::Google::Protobuf::MessageExts::ClassMethods
|
|
@@ -35,11 +34,9 @@ module Google
|
|
|
35
34
|
# Request message for [BinauthzManagementService.UpdatePolicy][].
|
|
36
35
|
# @!attribute [rw] policy
|
|
37
36
|
# @return [::Google::Cloud::BinaryAuthorization::V1beta1::Policy]
|
|
38
|
-
# Required. A new or updated
|
|
39
|
-
# {::Google::Cloud::BinaryAuthorization::V1beta1::Policy policy}
|
|
40
|
-
#
|
|
41
|
-
# name][google.cloud.binaryauthorization.v1beta1.Policy.name] field with the
|
|
42
|
-
# resource name in the request URL, in the format `projects/*/policy`.
|
|
37
|
+
# Required. A new or updated {::Google::Cloud::BinaryAuthorization::V1beta1::Policy policy} value. The service will
|
|
38
|
+
# overwrite the {::Google::Cloud::BinaryAuthorization::V1beta1::Policy#name policy name} field with the resource name in
|
|
39
|
+
# the request URL, in the format `projects/*/policy`.
|
|
43
40
|
class UpdatePolicyRequest
|
|
44
41
|
include ::Google::Protobuf::MessageExts
|
|
45
42
|
extend ::Google::Protobuf::MessageExts::ClassMethods
|
|
@@ -48,19 +45,15 @@ module Google
|
|
|
48
45
|
# Request message for [BinauthzManagementService.CreateAttestor][].
|
|
49
46
|
# @!attribute [rw] parent
|
|
50
47
|
# @return [::String]
|
|
51
|
-
# Required. The parent of this
|
|
52
|
-
# {::Google::Cloud::BinaryAuthorization::V1beta1::Attestor attestor}.
|
|
48
|
+
# Required. The parent of this {::Google::Cloud::BinaryAuthorization::V1beta1::Attestor attestor}.
|
|
53
49
|
# @!attribute [rw] attestor_id
|
|
54
50
|
# @return [::String]
|
|
55
|
-
# Required. The
|
|
56
|
-
# {::Google::Cloud::BinaryAuthorization::V1beta1::Attestor attestors} ID.
|
|
51
|
+
# Required. The {::Google::Cloud::BinaryAuthorization::V1beta1::Attestor attestors} ID.
|
|
57
52
|
# @!attribute [rw] attestor
|
|
58
53
|
# @return [::Google::Cloud::BinaryAuthorization::V1beta1::Attestor]
|
|
59
|
-
# Required. The initial
|
|
60
|
-
# {::Google::Cloud::BinaryAuthorization::V1beta1::Attestor attestor}
|
|
61
|
-
#
|
|
62
|
-
# name][google.cloud.binaryauthorization.v1beta1.Attestor.name] field with
|
|
63
|
-
# the resource name, in the format `projects/*/attestors/*`.
|
|
54
|
+
# Required. The initial {::Google::Cloud::BinaryAuthorization::V1beta1::Attestor attestor} value. The service will
|
|
55
|
+
# overwrite the {::Google::Cloud::BinaryAuthorization::V1beta1::Attestor#name attestor name} field with the resource name,
|
|
56
|
+
# in the format `projects/*/attestors/*`.
|
|
64
57
|
class CreateAttestorRequest
|
|
65
58
|
include ::Google::Protobuf::MessageExts
|
|
66
59
|
extend ::Google::Protobuf::MessageExts::ClassMethods
|
|
@@ -69,9 +62,8 @@ module Google
|
|
|
69
62
|
# Request message for [BinauthzManagementService.GetAttestor][].
|
|
70
63
|
# @!attribute [rw] name
|
|
71
64
|
# @return [::String]
|
|
72
|
-
# Required. The name of the
|
|
73
|
-
#
|
|
74
|
-
# in the format `projects/*/attestors/*`.
|
|
65
|
+
# Required. The name of the {::Google::Cloud::BinaryAuthorization::V1beta1::Attestor attestor} to retrieve, in the format
|
|
66
|
+
# `projects/*/attestors/*`.
|
|
75
67
|
class GetAttestorRequest
|
|
76
68
|
include ::Google::Protobuf::MessageExts
|
|
77
69
|
extend ::Google::Protobuf::MessageExts::ClassMethods
|
|
@@ -80,12 +72,9 @@ module Google
|
|
|
80
72
|
# Request message for [BinauthzManagementService.UpdateAttestor][].
|
|
81
73
|
# @!attribute [rw] attestor
|
|
82
74
|
# @return [::Google::Cloud::BinaryAuthorization::V1beta1::Attestor]
|
|
83
|
-
# Required. The updated
|
|
84
|
-
# {::Google::Cloud::BinaryAuthorization::V1beta1::Attestor attestor}
|
|
85
|
-
#
|
|
86
|
-
# name][google.cloud.binaryauthorization.v1beta1.Attestor.name] field with
|
|
87
|
-
# the resource name in the request URL, in the format
|
|
88
|
-
# `projects/*/attestors/*`.
|
|
75
|
+
# Required. The updated {::Google::Cloud::BinaryAuthorization::V1beta1::Attestor attestor} value. The service will
|
|
76
|
+
# overwrite the {::Google::Cloud::BinaryAuthorization::V1beta1::Attestor#name attestor name} field with the resource name
|
|
77
|
+
# in the request URL, in the format `projects/*/attestors/*`.
|
|
89
78
|
class UpdateAttestorRequest
|
|
90
79
|
include ::Google::Protobuf::MessageExts
|
|
91
80
|
extend ::Google::Protobuf::MessageExts::ClassMethods
|
|
@@ -95,8 +84,7 @@ module Google
|
|
|
95
84
|
# @!attribute [rw] parent
|
|
96
85
|
# @return [::String]
|
|
97
86
|
# Required. The resource name of the project associated with the
|
|
98
|
-
# {::Google::Cloud::BinaryAuthorization::V1beta1::Attestor attestors}, in the
|
|
99
|
-
# format `projects/*`.
|
|
87
|
+
# {::Google::Cloud::BinaryAuthorization::V1beta1::Attestor attestors}, in the format `projects/*`.
|
|
100
88
|
# @!attribute [rw] page_size
|
|
101
89
|
# @return [::Integer]
|
|
102
90
|
# Requested page size. The server may return fewer results than requested. If
|
|
@@ -104,9 +92,8 @@ module Google
|
|
|
104
92
|
# @!attribute [rw] page_token
|
|
105
93
|
# @return [::String]
|
|
106
94
|
# A token identifying a page of results the server should return. Typically,
|
|
107
|
-
# this is the value of
|
|
108
|
-
#
|
|
109
|
-
# returned from the previous call to the `ListAttestors` method.
|
|
95
|
+
# this is the value of {::Google::Cloud::BinaryAuthorization::V1beta1::ListAttestorsResponse#next_page_token ListAttestorsResponse.next_page_token} returned
|
|
96
|
+
# from the previous call to the `ListAttestors` method.
|
|
110
97
|
class ListAttestorsRequest
|
|
111
98
|
include ::Google::Protobuf::MessageExts
|
|
112
99
|
extend ::Google::Protobuf::MessageExts::ClassMethods
|
|
@@ -119,9 +106,8 @@ module Google
|
|
|
119
106
|
# @!attribute [rw] next_page_token
|
|
120
107
|
# @return [::String]
|
|
121
108
|
# A token to retrieve the next page of results. Pass this value in the
|
|
122
|
-
# {::Google::Cloud::BinaryAuthorization::V1beta1::ListAttestorsRequest#page_token ListAttestorsRequest.page_token}
|
|
123
|
-
#
|
|
124
|
-
# next page of results.
|
|
109
|
+
# {::Google::Cloud::BinaryAuthorization::V1beta1::ListAttestorsRequest#page_token ListAttestorsRequest.page_token} field in the subsequent call to the
|
|
110
|
+
# `ListAttestors` method to retrieve the next page of results.
|
|
125
111
|
class ListAttestorsResponse
|
|
126
112
|
include ::Google::Protobuf::MessageExts
|
|
127
113
|
extend ::Google::Protobuf::MessageExts::ClassMethods
|
|
@@ -130,13 +116,22 @@ module Google
|
|
|
130
116
|
# Request message for [BinauthzManagementService.DeleteAttestor][].
|
|
131
117
|
# @!attribute [rw] name
|
|
132
118
|
# @return [::String]
|
|
133
|
-
# Required. The name of the
|
|
134
|
-
#
|
|
135
|
-
# in the format `projects/*/attestors/*`.
|
|
119
|
+
# Required. The name of the {::Google::Cloud::BinaryAuthorization::V1beta1::Attestor attestors} to delete, in the format
|
|
120
|
+
# `projects/*/attestors/*`.
|
|
136
121
|
class DeleteAttestorRequest
|
|
137
122
|
include ::Google::Protobuf::MessageExts
|
|
138
123
|
extend ::Google::Protobuf::MessageExts::ClassMethods
|
|
139
124
|
end
|
|
125
|
+
|
|
126
|
+
# Request to read the current system policy.
|
|
127
|
+
# @!attribute [rw] name
|
|
128
|
+
# @return [::String]
|
|
129
|
+
# Required. The resource name, in the format `locations/*/policy`.
|
|
130
|
+
# Note that the system policy is not associated with a project.
|
|
131
|
+
class GetSystemPolicyRequest
|
|
132
|
+
include ::Google::Protobuf::MessageExts
|
|
133
|
+
extend ::Google::Protobuf::MessageExts::ClassMethods
|
|
134
|
+
end
|
|
140
135
|
end
|
|
141
136
|
end
|
|
142
137
|
end
|