package google.cloud.binaryauthorization.v1beta1

Get desktop application:
View/edit binary Protocol Buffers messages

Google Cloud Management Service for Binary Authorization admission policies and attestation authorities. This API implements a REST model with the following objects: * [Policy][google.cloud.binaryauthorization.v1beta1.Policy] * [Attestor][google.cloud.binaryauthorization.v1beta1.Attestor]

• rpc GetPolicy (GetPolicyRequest, Policy)

  service.proto:50

  A [policy][google.cloud.binaryauthorization.v1beta1.Policy] specifies the [attestors][google.cloud.binaryauthorization.v1beta1.Attestor] that must attest to a container image, before the project is allowed to deploy that image. There is at most one policy per project. All image admission requests are permitted if a project has no policy. Gets the [policy][google.cloud.binaryauthorization.v1beta1.Policy] for this project. Returns a default [policy][google.cloud.binaryauthorization.v1beta1.Policy] if the project does not have one.

  message GetPolicyRequest

  service.proto:121

  Request message for [BinauthzManagementService.GetPolicy][].

  • string name = 1

    Required. The resource name of the [policy][google.cloud.binaryauthorization.v1beta1.Policy] to retrieve, in the format `projects/*/policy`.

• rpc UpdatePolicy (UpdatePolicyRequest, Policy)

  service.proto:62

  Creates or updates a project's [policy][google.cloud.binaryauthorization.v1beta1.Policy], and returns a copy of the new [policy][google.cloud.binaryauthorization.v1beta1.Policy]. A policy is always updated as a whole, to avoid race conditions with concurrent policy enforcement (or management!) requests. Returns NOT_FOUND if the project does not exist, INVALID_ARGUMENT if the request is malformed.

  message UpdatePolicyRequest

  service.proto:133

  Request message for [BinauthzManagementService.UpdatePolicy][].

  • optional Policy policy = 1

    Required. A new or updated [policy][google.cloud.binaryauthorization.v1beta1.Policy] value. The service will overwrite the [policy name][google.cloud.binaryauthorization.v1beta1.Policy.name] field with the resource name in the request URL, in the format `projects/*/policy`.

• rpc CreateAttestor (CreateAttestorRequest, Attestor)

  service.proto:74

  Creates an [attestor][google.cloud.binaryauthorization.v1beta1.Attestor], and returns a copy of the new [attestor][google.cloud.binaryauthorization.v1beta1.Attestor]. Returns NOT_FOUND if the project does not exist, INVALID_ARGUMENT if the request is malformed, ALREADY_EXISTS if the [attestor][google.cloud.binaryauthorization.v1beta1.Attestor] already exists.

  message CreateAttestorRequest

  service.proto:141

  Request message for [BinauthzManagementService.CreateAttestor][].

  • string parent = 1

    Required. The parent of this [attestor][google.cloud.binaryauthorization.v1beta1.Attestor].

  • string attestor_id = 2

    Required. The [attestors][google.cloud.binaryauthorization.v1beta1.Attestor] ID.

  • optional Attestor attestor = 3

    Required. The initial [attestor][google.cloud.binaryauthorization.v1beta1.Attestor] value. The service will overwrite the [attestor name][google.cloud.binaryauthorization.v1beta1.Attestor.name] field with the resource name, in the format `projects/*/attestors/*`.

• rpc GetAttestor (GetAttestorRequest, Attestor)

  service.proto:84

  Gets an [attestor][google.cloud.binaryauthorization.v1beta1.Attestor]. Returns NOT_FOUND if the [attestor][google.cloud.binaryauthorization.v1beta1.Attestor] does not exist.

  message GetAttestorRequest

  service.proto:160

  Request message for [BinauthzManagementService.GetAttestor][].

  • string name = 1

    Required. The name of the [attestor][google.cloud.binaryauthorization.v1beta1.Attestor] to retrieve, in the format `projects/*/attestors/*`.

• rpc UpdateAttestor (UpdateAttestorRequest, Attestor)

  service.proto:93

  Updates an [attestor][google.cloud.binaryauthorization.v1beta1.Attestor]. Returns NOT_FOUND if the [attestor][google.cloud.binaryauthorization.v1beta1.Attestor] does not exist.

  message UpdateAttestorRequest

  service.proto:172

  Request message for [BinauthzManagementService.UpdateAttestor][].

  • optional Attestor attestor = 1

    Required. The updated [attestor][google.cloud.binaryauthorization.v1beta1.Attestor] value. The service will overwrite the [attestor name][google.cloud.binaryauthorization.v1beta1.Attestor.name] field with the resource name in the request URL, in the format `projects/*/attestors/*`.

• rpc ListAttestors (ListAttestorsRequest, ListAttestorsResponse)

  service.proto:103

  Lists [attestors][google.cloud.binaryauthorization.v1beta1.Attestor]. Returns INVALID_ARGUMENT if the project does not exist.

  message ListAttestorsRequest

  service.proto:180

  Request message for [BinauthzManagementService.ListAttestors][].

  • string parent = 1

    Required. The resource name of the project associated with the [attestors][google.cloud.binaryauthorization.v1beta1.Attestor], in the format `projects/*`.

  • int32 page_size = 2

    Requested page size. The server may return fewer results than requested. If unspecified, the server will pick an appropriate default.

  • string page_token = 3

    A token identifying a page of results the server should return. Typically, this is the value of [ListAttestorsResponse.next_page_token][google.cloud.binaryauthorization.v1beta1.ListAttestorsResponse.next_page_token] returned from the previous call to the `ListAttestors` method.

  message ListAttestorsResponse

  service.proto:201

  Response message for [BinauthzManagementService.ListAttestors][].

  • repeated Attestor attestors = 1

    The list of [attestors][google.cloud.binaryauthorization.v1beta1.Attestor].

  • string next_page_token = 2

    A token to retrieve the next page of results. Pass this value in the [ListAttestorsRequest.page_token][google.cloud.binaryauthorization.v1beta1.ListAttestorsRequest.page_token] field in the subsequent call to the `ListAttestors` method to retrieve the next page of results.

• rpc DeleteAttestor (DeleteAttestorRequest, protobuf.Empty)

  service.proto:112

  Deletes an [attestor][google.cloud.binaryauthorization.v1beta1.Attestor]. Returns NOT_FOUND if the [attestor][google.cloud.binaryauthorization.v1beta1.Attestor] does not exist.

  message DeleteAttestorRequest

  service.proto:212

  Request message for [BinauthzManagementService.DeleteAttestor][].

  • string name = 1

    Required. The name of the [attestors][google.cloud.binaryauthorization.v1beta1.Attestor] to delete, in the format `projects/*/attestors/*`.

An [admission rule][google.cloud.binaryauthorization.v1beta1.AdmissionRule] specifies either that all container images used in a pod creation request must be attested to by one or more [attestors][google.cloud.binaryauthorization.v1beta1.Attestor], that all pod creations will be allowed, or that all pod creations will be denied. Images matching an [admission whitelist pattern][google.cloud.binaryauthorization.v1beta1.AdmissionWhitelistPattern] are exempted from admission rules and will never block a pod creation.

Used in: Policy

• AdmissionRule.EvaluationMode evaluation_mode = 1

  Required. How this admission rule will be evaluated.

• repeated string require_attestations_by = 2

  Optional. The resource names of the attestors that must attest to a container image, in the format `projects/*/attestors/*`. Each attestor must exist before a policy can reference it. To add an attestor to a policy the principal issuing the policy change request must be able to read the attestor resource. Note: this field must be non-empty when the evaluation_mode field specifies REQUIRE_ATTESTATION, otherwise it must be empty.

• AdmissionRule.EnforcementMode enforcement_mode = 3

  Required. The action when a pod creation is denied by the admission rule.

Defines the possible actions when a pod creation is denied by an admission rule.

Used in: AdmissionRule

• ENFORCEMENT_MODE_UNSPECIFIED = 0

  Do not use.

• ENFORCED_BLOCK_AND_AUDIT_LOG = 1

  Enforce the admission rule by blocking the pod creation.

• DRYRUN_AUDIT_LOG_ONLY = 2

  Dryrun mode: Audit logging only. This will allow the pod creation as if the admission request had specified break-glass.

Used in: AdmissionRule

• EVALUATION_MODE_UNSPECIFIED = 0

  Do not use.

• ALWAYS_ALLOW = 1

  This rule allows all all pod creations.

• REQUIRE_ATTESTATION = 2

  This rule allows a pod creation if all the attestors listed in 'require_attestations_by' have valid attestations for all of the images in the pod spec.

• ALWAYS_DENY = 3

  This rule denies all pod creations.

An [admission whitelist pattern][google.cloud.binaryauthorization.v1beta1.AdmissionWhitelistPattern] exempts images from checks by [admission rules][google.cloud.binaryauthorization.v1beta1.AdmissionRule].

Used in: Policy

• string name_pattern = 1

  An image name pattern to whitelist, in the form `registry/path/to/image`. This supports a trailing `*` as a wildcard, but this is allowed only in text after the `registry/` part.

An [attestor][google.cloud.binaryauthorization.v1beta1.Attestor] that attests to container image artifacts. An existing attestor cannot be modified except where indicated.

Used as response type in: BinauthzManagementServiceV1Beta1.CreateAttestor, BinauthzManagementServiceV1Beta1.GetAttestor, BinauthzManagementServiceV1Beta1.UpdateAttestor

Used as field type in: CreateAttestorRequest, ListAttestorsResponse, UpdateAttestorRequest

• string name = 1

  Required. The resource name, in the format: `projects/*/attestors/*`. This field may not be updated.

• string description = 6

  Optional. A descriptive comment. This field may be updated. The field may be displayed in chooser dialogs.

• oneof attestor_type

  Required. Identifies an [attestor][google.cloud.binaryauthorization.v1beta1.Attestor] that attests to a container image artifact. This determines how an attestation will be stored, and how it will be used during policy enforcement. Updates may not change the attestor type, but individual attestor fields may be updated

  • UserOwnedDrydockNote user_owned_drydock_note = 3

    A Drydock ATTESTATION_AUTHORITY Note, created by the user.

• optional protobuf.Timestamp update_time = 4

  Output only. Time when the attestor was last updated.

An [attestor public key][google.cloud.binaryauthorization.v1beta1.AttestorPublicKey] that will be used to verify attestations signed by this attestor.

Used in: UserOwnedDrydockNote

• string comment = 1

  Optional. A descriptive comment. This field may be updated.

• string id = 2

  The ID of this public key. Signatures verified by BinAuthz must include the ID of the public key that can be used to verify them, and that ID must match the contents of this field exactly. Additional restrictions on this field can be imposed based on which public key type is encapsulated. See the documentation on `public_key` cases below for details.

• oneof public_key

  Required. A public key reference or serialized instance. This field may be updated.

  • string ascii_armored_pgp_public_key = 3

    ASCII-armored representation of a PGP public key, as the entire output by the command `gpg --export --armor foo@example.com` (either LF or CRLF line endings). When using this field, `id` should be left blank. The BinAuthz API handlers will calculate the ID and fill it in automatically. BinAuthz computes this ID as the OpenPGP RFC4880 V4 fingerprint, represented as upper-case hex. If `id` is provided by the caller, it will be overwritten by the API-calculated ID.

  • PkixPublicKey pkix_public_key = 5

    A raw PKIX SubjectPublicKeyInfo format public key. NOTE: `id` may be explicitly provided by the caller when using this type of public key, but it MUST be a valid RFC3986 URI. If `id` is left blank, a default one will be computed based on the digest of the DER encoding of the public key.

A public key in the PkixPublicKey format (see https://tools.ietf.org/html/rfc5280#section-4.1.2.7 for details). Public keys of this type are typically textually encoded using the PEM format.

Used in: AttestorPublicKey

• string public_key_pem = 1

  A PEM-encoded public key, as described in https://tools.ietf.org/html/rfc7468#section-13

• PkixPublicKey.SignatureAlgorithm signature_algorithm = 2

  The signature algorithm used to verify a message against a signature using this key. These signature algorithm must match the structure and any object identifiers encoded in `public_key_pem` (i.e. this algorithm must match that of the public key).

Represents a signature algorithm and other information necessary to verify signatures with a given public key. This is based primarily on the public key types supported by Tink's PemKeyType, which is in turn based on KMS's supported signing algorithms. See https://cloud.google.com/kms/docs/algorithms. In the future, BinAuthz might support additional public key types independently of Tink and/or KMS.

Used in: PkixPublicKey

• SIGNATURE_ALGORITHM_UNSPECIFIED = 0

  Not specified.

• RSA_PSS_2048_SHA256 = 1

  RSASSA-PSS 2048 bit key with a SHA256 digest.

• RSA_PSS_3072_SHA256 = 2

  RSASSA-PSS 3072 bit key with a SHA256 digest.

• RSA_PSS_4096_SHA256 = 3

  RSASSA-PSS 4096 bit key with a SHA256 digest.

• RSA_PSS_4096_SHA512 = 4

  RSASSA-PSS 4096 bit key with a SHA512 digest.

• RSA_SIGN_PKCS1_2048_SHA256 = 5

  RSASSA-PKCS1-v1_5 with a 2048 bit key and a SHA256 digest.

• RSA_SIGN_PKCS1_3072_SHA256 = 6

  RSASSA-PKCS1-v1_5 with a 3072 bit key and a SHA256 digest.

• RSA_SIGN_PKCS1_4096_SHA256 = 7

  RSASSA-PKCS1-v1_5 with a 4096 bit key and a SHA256 digest.

• RSA_SIGN_PKCS1_4096_SHA512 = 8

  RSASSA-PKCS1-v1_5 with a 4096 bit key and a SHA512 digest.

• ECDSA_P256_SHA256 = 9

  ECDSA on the NIST P-256 curve with a SHA256 digest.

• ECDSA_P384_SHA384 = 10

  ECDSA on the NIST P-384 curve with a SHA384 digest.

• ECDSA_P521_SHA512 = 11

  ECDSA on the NIST P-521 curve with a SHA512 digest.

A [policy][google.cloud.binaryauthorization.v1beta1.Policy] for container image binary authorization.

Used as response type in: BinauthzManagementServiceV1Beta1.GetPolicy, BinauthzManagementServiceV1Beta1.UpdatePolicy

Used as field type in: UpdatePolicyRequest

• string name = 1

  Output only. The resource name, in the format `projects/*/policy`. There is at most one policy per project.

• string description = 6

  Optional. A descriptive comment.

• Policy.GlobalPolicyEvaluationMode global_policy_evaluation_mode = 7

  Optional. Controls the evaluation of a Google-maintained global admission policy for common system-level images. Images not covered by the global policy will be subject to the project admission policy. This setting has no effect when specified inside a global admission policy.

• repeated AdmissionWhitelistPattern admission_whitelist_patterns = 2

  Optional. Admission policy whitelisting. A matching admission request will always be permitted. This feature is typically used to exclude Google or third-party infrastructure images from Binary Authorization policies.

• map<string, AdmissionRule> cluster_admission_rules = 3

  Optional. Per-cluster admission rules. Cluster spec format: `location.clusterId`. There can be at most one admission rule per cluster spec. A `location` is either a compute zone (e.g. us-central1-a) or a region (e.g. us-central1). For `clusterId` syntax restrictions see https://cloud.google.com/container-engine/reference/rest/v1/projects.zones.clusters.

• optional AdmissionRule default_admission_rule = 4

  Required. Default admission rule for a cluster without a per-cluster, per- kubernetes-service-account, or per-istio-service-identity admission rule.

• optional protobuf.Timestamp update_time = 5

  Output only. Time when the policy was last updated.

Used in: Policy

• GLOBAL_POLICY_EVALUATION_MODE_UNSPECIFIED = 0

  Not specified: DISABLE is assumed.

• ENABLE = 1

  Enables global policy evaluation.

• DISABLE = 2

  Disables global policy evaluation.

An [user owned drydock note][google.cloud.binaryauthorization.v1beta1.UserOwnedDrydockNote] references a Drydock ATTESTATION_AUTHORITY Note created by the user.

Used in: Attestor

• string note_reference = 1

  Required. The Drydock resource name of a ATTESTATION_AUTHORITY Note, created by the user, in the format: `projects/*/notes/*` (or the legacy `providers/*/notes/*`). This field may not be updated. An attestation by this attestor is stored as a Drydock ATTESTATION_AUTHORITY Occurrence that names a container image and that links to this Note. Drydock is an external dependency.

• repeated AttestorPublicKey public_keys = 2

  Optional. Public keys that verify attestations signed by this attestor. This field may be updated. If this field is non-empty, one of the specified public keys must verify that an attestation was signed by this attestor for the image specified in the admission request. If this field is empty, this attestor always returns that no valid attestations exist.

• string delegation_service_account_email = 3

  Output only. This field will contain the service account email address that this Attestor will use as the principal when querying Container Analysis. Attestor administrators must grant this service account the IAM role needed to read attestations from the [note_reference][Note] in Container Analysis (`containeranalysis.notes.occurrences.viewer`). This email address is fixed for the lifetime of the Attestor, but callers should not make any other assumptions about the service account email; future versions may use an email based on a different naming pattern.