Binary Authorization API . projects . platforms . gke . policies

close()

Close httplib2 connections.

evaluate(name, body=None, x__xgafv=None)

Evaluates a Kubernetes object versus a GKE platform policy. Returns `NOT_FOUND` if the policy doesn't exist, `INVALID_ARGUMENT` if the policy or request is malformed and `PERMISSION_DENIED` if the client does not have sufficient permissions.

Args:
  name: string, Required. The name of the platform policy to evaluate in the format `projects/*/platforms/*/policies/*`. (required)
  body: object, The request body.
    The object takes the form of:

{ # Request message for PlatformPolicyEvaluationService.EvaluateGkePolicy.
  "resource": { # Required. JSON or YAML blob representing a Kubernetes resource.
    "a_key": "", # Properties of the object.
  },
}

  x__xgafv: string, V1 error format.
    Allowed values
      1 - v1 error format
      2 - v2 error format

Returns:
  An object of the form:

    { # Response message for PlatformPolicyEvaluationService.EvaluateGkePolicy.
  "results": [ # Evaluation result for each Pod contained in the request.
    { # Result of evaluating the whole GKE policy for one Pod.
      "imageResults": [ # Per-image details.
        { # Result of evaluating one image.
          "allowlistResult": { # Result of evaluating an image name allowlist. # If the image was exempted by a top-level allow_pattern, contains the allowlist pattern that the image name matched.
            "matchedPattern": "A String", # The allowlist pattern that the image matched.
          },
          "checkSetResult": { # Result of evaluating one check set. # If a check set was evaluated, contains the result of the check set. Empty if there were no check sets.
            "allowlistResult": { # Result of evaluating an image name allowlist. # If the image was exempted by an allow_pattern in the check set, contains the pattern that the image name matched.
              "matchedPattern": "A String", # The allowlist pattern that the image matched.
            },
            "checkResults": { # Result of evaluating one or more checks. # If checks were evaluated, contains the results of evaluating each check.
              "results": [ # Per-check details.
                { # Result of evaluating one check.
                  "allowlistResult": { # Result of evaluating an image name allowlist. # If the image was exempted by an allow_pattern in the check, contains the pattern that the image name matched.
                    "matchedPattern": "A String", # The allowlist pattern that the image matched.
                  },
                  "displayName": "A String", # The name of the check.
                  "evaluationResult": { # Result of evaluating one check. # If a check was evaluated, contains the result of the check.
                    "verdict": "A String", # The result of evaluating this check.
                  },
                  "explanation": "A String", # Explanation of this check result.
                  "index": "A String", # The index of the check.
                  "type": "A String", # The type of the check.
                },
              ],
            },
            "displayName": "A String", # The name of the check set.
            "explanation": "A String", # Explanation of this check set result. Only populated if no checks were evaluated.
            "index": "A String", # The index of the check set.
            "scope": { # A scope specifier for `CheckSet` objects. # The scope of the check set.
              "kubernetesNamespace": "A String", # Optional. Matches all Kubernetes service accounts in the provided namespace, unless a more specific `kubernetes_service_account` scope already matched.
              "kubernetesServiceAccount": "A String", # Optional. Matches a single Kubernetes service account, e.g. `my-namespace:my-service-account`. `kubernetes_service_account` scope is always more specific than `kubernetes_namespace` scope for the same namespace.
            },
          },
          "explanation": "A String", # Explanation of this image result. Only populated if no check sets were evaluated.
          "imageUri": "A String", # Image URI from the request.
          "verdict": "A String", # The result of evaluating this image.
        },
      ],
      "kubernetesNamespace": "A String", # The Kubernetes namespace of the Pod.
      "kubernetesServiceAccount": "A String", # The Kubernetes service account of the Pod.
      "podName": "A String", # The name of the Pod.
      "verdict": "A String", # The result of evaluating this Pod.
    },
  ],
  "verdict": "A String", # The result of evaluating all Pods in the request.
}