Documentation ¶
Index ¶
- Variables
- func RegisterBinauthzManagementServiceV1Beta1Server(s *grpc.Server, srv BinauthzManagementServiceV1Beta1Server)
- type AdmissionRule
- func (*AdmissionRule) Descriptor() ([]byte, []int)
- func (m *AdmissionRule) GetEnforcementMode() AdmissionRule_EnforcementMode
- func (m *AdmissionRule) GetEvaluationMode() AdmissionRule_EvaluationMode
- func (m *AdmissionRule) GetRequireAttestationsBy() []string
- func (*AdmissionRule) ProtoMessage()
- func (m *AdmissionRule) Reset()
- func (m *AdmissionRule) String() string
- func (m *AdmissionRule) XXX_DiscardUnknown()
- func (m *AdmissionRule) XXX_Marshal(b []byte, deterministic bool) ([]byte, error)
- func (m *AdmissionRule) XXX_Merge(src proto.Message)
- func (m *AdmissionRule) XXX_Size() int
- func (m *AdmissionRule) XXX_Unmarshal(b []byte) error
- type AdmissionRule_EnforcementMode
- type AdmissionRule_EvaluationMode
- type AdmissionWhitelistPattern
- func (*AdmissionWhitelistPattern) Descriptor() ([]byte, []int)
- func (m *AdmissionWhitelistPattern) GetNamePattern() string
- func (*AdmissionWhitelistPattern) ProtoMessage()
- func (m *AdmissionWhitelistPattern) Reset()
- func (m *AdmissionWhitelistPattern) String() string
- func (m *AdmissionWhitelistPattern) XXX_DiscardUnknown()
- func (m *AdmissionWhitelistPattern) XXX_Marshal(b []byte, deterministic bool) ([]byte, error)
- func (m *AdmissionWhitelistPattern) XXX_Merge(src proto.Message)
- func (m *AdmissionWhitelistPattern) XXX_Size() int
- func (m *AdmissionWhitelistPattern) XXX_Unmarshal(b []byte) error
- type Attestor
- func (*Attestor) Descriptor() ([]byte, []int)
- func (m *Attestor) GetAttestorType() isAttestor_AttestorType
- func (m *Attestor) GetDescription() string
- func (m *Attestor) GetName() string
- func (m *Attestor) GetUpdateTime() *timestamp.Timestamp
- func (m *Attestor) GetUserOwnedDrydockNote() *UserOwnedDrydockNote
- func (*Attestor) ProtoMessage()
- func (m *Attestor) Reset()
- func (m *Attestor) String() string
- func (m *Attestor) XXX_DiscardUnknown()
- func (m *Attestor) XXX_Marshal(b []byte, deterministic bool) ([]byte, error)
- func (m *Attestor) XXX_Merge(src proto.Message)
- func (*Attestor) XXX_OneofWrappers() []interface{}
- func (m *Attestor) XXX_Size() int
- func (m *Attestor) XXX_Unmarshal(b []byte) error
- type AttestorPublicKey
- func (*AttestorPublicKey) Descriptor() ([]byte, []int)
- func (m *AttestorPublicKey) GetAsciiArmoredPgpPublicKey() string
- func (m *AttestorPublicKey) GetComment() string
- func (m *AttestorPublicKey) GetId() string
- func (m *AttestorPublicKey) GetPkixPublicKey() *PkixPublicKey
- func (m *AttestorPublicKey) GetPublicKey() isAttestorPublicKey_PublicKey
- func (*AttestorPublicKey) ProtoMessage()
- func (m *AttestorPublicKey) Reset()
- func (m *AttestorPublicKey) String() string
- func (m *AttestorPublicKey) XXX_DiscardUnknown()
- func (m *AttestorPublicKey) XXX_Marshal(b []byte, deterministic bool) ([]byte, error)
- func (m *AttestorPublicKey) XXX_Merge(src proto.Message)
- func (*AttestorPublicKey) XXX_OneofWrappers() []interface{}
- func (m *AttestorPublicKey) XXX_Size() int
- func (m *AttestorPublicKey) XXX_Unmarshal(b []byte) error
- type AttestorPublicKey_AsciiArmoredPgpPublicKey
- type AttestorPublicKey_PkixPublicKey
- type Attestor_UserOwnedDrydockNote
- type BinauthzManagementServiceV1Beta1Client
- type BinauthzManagementServiceV1Beta1Server
- type CreateAttestorRequest
- func (*CreateAttestorRequest) Descriptor() ([]byte, []int)
- func (m *CreateAttestorRequest) GetAttestor() *Attestor
- func (m *CreateAttestorRequest) GetAttestorId() string
- func (m *CreateAttestorRequest) GetParent() string
- func (*CreateAttestorRequest) ProtoMessage()
- func (m *CreateAttestorRequest) Reset()
- func (m *CreateAttestorRequest) String() string
- func (m *CreateAttestorRequest) XXX_DiscardUnknown()
- func (m *CreateAttestorRequest) XXX_Marshal(b []byte, deterministic bool) ([]byte, error)
- func (m *CreateAttestorRequest) XXX_Merge(src proto.Message)
- func (m *CreateAttestorRequest) XXX_Size() int
- func (m *CreateAttestorRequest) XXX_Unmarshal(b []byte) error
- type DeleteAttestorRequest
- func (*DeleteAttestorRequest) Descriptor() ([]byte, []int)
- func (m *DeleteAttestorRequest) GetName() string
- func (*DeleteAttestorRequest) ProtoMessage()
- func (m *DeleteAttestorRequest) Reset()
- func (m *DeleteAttestorRequest) String() string
- func (m *DeleteAttestorRequest) XXX_DiscardUnknown()
- func (m *DeleteAttestorRequest) XXX_Marshal(b []byte, deterministic bool) ([]byte, error)
- func (m *DeleteAttestorRequest) XXX_Merge(src proto.Message)
- func (m *DeleteAttestorRequest) XXX_Size() int
- func (m *DeleteAttestorRequest) XXX_Unmarshal(b []byte) error
- type GetAttestorRequest
- func (*GetAttestorRequest) Descriptor() ([]byte, []int)
- func (m *GetAttestorRequest) GetName() string
- func (*GetAttestorRequest) ProtoMessage()
- func (m *GetAttestorRequest) Reset()
- func (m *GetAttestorRequest) String() string
- func (m *GetAttestorRequest) XXX_DiscardUnknown()
- func (m *GetAttestorRequest) XXX_Marshal(b []byte, deterministic bool) ([]byte, error)
- func (m *GetAttestorRequest) XXX_Merge(src proto.Message)
- func (m *GetAttestorRequest) XXX_Size() int
- func (m *GetAttestorRequest) XXX_Unmarshal(b []byte) error
- type GetPolicyRequest
- func (*GetPolicyRequest) Descriptor() ([]byte, []int)
- func (m *GetPolicyRequest) GetName() string
- func (*GetPolicyRequest) ProtoMessage()
- func (m *GetPolicyRequest) Reset()
- func (m *GetPolicyRequest) String() string
- func (m *GetPolicyRequest) XXX_DiscardUnknown()
- func (m *GetPolicyRequest) XXX_Marshal(b []byte, deterministic bool) ([]byte, error)
- func (m *GetPolicyRequest) XXX_Merge(src proto.Message)
- func (m *GetPolicyRequest) XXX_Size() int
- func (m *GetPolicyRequest) XXX_Unmarshal(b []byte) error
- type ListAttestorsRequest
- func (*ListAttestorsRequest) Descriptor() ([]byte, []int)
- func (m *ListAttestorsRequest) GetPageSize() int32
- func (m *ListAttestorsRequest) GetPageToken() string
- func (m *ListAttestorsRequest) GetParent() string
- func (*ListAttestorsRequest) ProtoMessage()
- func (m *ListAttestorsRequest) Reset()
- func (m *ListAttestorsRequest) String() string
- func (m *ListAttestorsRequest) XXX_DiscardUnknown()
- func (m *ListAttestorsRequest) XXX_Marshal(b []byte, deterministic bool) ([]byte, error)
- func (m *ListAttestorsRequest) XXX_Merge(src proto.Message)
- func (m *ListAttestorsRequest) XXX_Size() int
- func (m *ListAttestorsRequest) XXX_Unmarshal(b []byte) error
- type ListAttestorsResponse
- func (*ListAttestorsResponse) Descriptor() ([]byte, []int)
- func (m *ListAttestorsResponse) GetAttestors() []*Attestor
- func (m *ListAttestorsResponse) GetNextPageToken() string
- func (*ListAttestorsResponse) ProtoMessage()
- func (m *ListAttestorsResponse) Reset()
- func (m *ListAttestorsResponse) String() string
- func (m *ListAttestorsResponse) XXX_DiscardUnknown()
- func (m *ListAttestorsResponse) XXX_Marshal(b []byte, deterministic bool) ([]byte, error)
- func (m *ListAttestorsResponse) XXX_Merge(src proto.Message)
- func (m *ListAttestorsResponse) XXX_Size() int
- func (m *ListAttestorsResponse) XXX_Unmarshal(b []byte) error
- type PkixPublicKey
- func (*PkixPublicKey) Descriptor() ([]byte, []int)
- func (m *PkixPublicKey) GetPublicKeyPem() string
- func (m *PkixPublicKey) GetSignatureAlgorithm() PkixPublicKey_SignatureAlgorithm
- func (*PkixPublicKey) ProtoMessage()
- func (m *PkixPublicKey) Reset()
- func (m *PkixPublicKey) String() string
- func (m *PkixPublicKey) XXX_DiscardUnknown()
- func (m *PkixPublicKey) XXX_Marshal(b []byte, deterministic bool) ([]byte, error)
- func (m *PkixPublicKey) XXX_Merge(src proto.Message)
- func (m *PkixPublicKey) XXX_Size() int
- func (m *PkixPublicKey) XXX_Unmarshal(b []byte) error
- type PkixPublicKey_SignatureAlgorithm
- type Policy
- func (*Policy) Descriptor() ([]byte, []int)
- func (m *Policy) GetAdmissionWhitelistPatterns() []*AdmissionWhitelistPattern
- func (m *Policy) GetClusterAdmissionRules() map[string]*AdmissionRule
- func (m *Policy) GetDefaultAdmissionRule() *AdmissionRule
- func (m *Policy) GetDescription() string
- func (m *Policy) GetGlobalPolicyEvaluationMode() Policy_GlobalPolicyEvaluationMode
- func (m *Policy) GetName() string
- func (m *Policy) GetUpdateTime() *timestamp.Timestamp
- func (*Policy) ProtoMessage()
- func (m *Policy) Reset()
- func (m *Policy) String() string
- func (m *Policy) XXX_DiscardUnknown()
- func (m *Policy) XXX_Marshal(b []byte, deterministic bool) ([]byte, error)
- func (m *Policy) XXX_Merge(src proto.Message)
- func (m *Policy) XXX_Size() int
- func (m *Policy) XXX_Unmarshal(b []byte) error
- type Policy_GlobalPolicyEvaluationMode
- type UnimplementedBinauthzManagementServiceV1Beta1Server
- func (*UnimplementedBinauthzManagementServiceV1Beta1Server) CreateAttestor(ctx context.Context, req *CreateAttestorRequest) (*Attestor, error)
- func (*UnimplementedBinauthzManagementServiceV1Beta1Server) DeleteAttestor(ctx context.Context, req *DeleteAttestorRequest) (*empty.Empty, error)
- func (*UnimplementedBinauthzManagementServiceV1Beta1Server) GetAttestor(ctx context.Context, req *GetAttestorRequest) (*Attestor, error)
- func (*UnimplementedBinauthzManagementServiceV1Beta1Server) GetPolicy(ctx context.Context, req *GetPolicyRequest) (*Policy, error)
- func (*UnimplementedBinauthzManagementServiceV1Beta1Server) ListAttestors(ctx context.Context, req *ListAttestorsRequest) (*ListAttestorsResponse, error)
- func (*UnimplementedBinauthzManagementServiceV1Beta1Server) UpdateAttestor(ctx context.Context, req *UpdateAttestorRequest) (*Attestor, error)
- func (*UnimplementedBinauthzManagementServiceV1Beta1Server) UpdatePolicy(ctx context.Context, req *UpdatePolicyRequest) (*Policy, error)
- type UpdateAttestorRequest
- func (*UpdateAttestorRequest) Descriptor() ([]byte, []int)
- func (m *UpdateAttestorRequest) GetAttestor() *Attestor
- func (*UpdateAttestorRequest) ProtoMessage()
- func (m *UpdateAttestorRequest) Reset()
- func (m *UpdateAttestorRequest) String() string
- func (m *UpdateAttestorRequest) XXX_DiscardUnknown()
- func (m *UpdateAttestorRequest) XXX_Marshal(b []byte, deterministic bool) ([]byte, error)
- func (m *UpdateAttestorRequest) XXX_Merge(src proto.Message)
- func (m *UpdateAttestorRequest) XXX_Size() int
- func (m *UpdateAttestorRequest) XXX_Unmarshal(b []byte) error
- type UpdatePolicyRequest
- func (*UpdatePolicyRequest) Descriptor() ([]byte, []int)
- func (m *UpdatePolicyRequest) GetPolicy() *Policy
- func (*UpdatePolicyRequest) ProtoMessage()
- func (m *UpdatePolicyRequest) Reset()
- func (m *UpdatePolicyRequest) String() string
- func (m *UpdatePolicyRequest) XXX_DiscardUnknown()
- func (m *UpdatePolicyRequest) XXX_Marshal(b []byte, deterministic bool) ([]byte, error)
- func (m *UpdatePolicyRequest) XXX_Merge(src proto.Message)
- func (m *UpdatePolicyRequest) XXX_Size() int
- func (m *UpdatePolicyRequest) XXX_Unmarshal(b []byte) error
- type UserOwnedDrydockNote
- func (*UserOwnedDrydockNote) Descriptor() ([]byte, []int)
- func (m *UserOwnedDrydockNote) GetDelegationServiceAccountEmail() string
- func (m *UserOwnedDrydockNote) GetNoteReference() string
- func (m *UserOwnedDrydockNote) GetPublicKeys() []*AttestorPublicKey
- func (*UserOwnedDrydockNote) ProtoMessage()
- func (m *UserOwnedDrydockNote) Reset()
- func (m *UserOwnedDrydockNote) String() string
- func (m *UserOwnedDrydockNote) XXX_DiscardUnknown()
- func (m *UserOwnedDrydockNote) XXX_Marshal(b []byte, deterministic bool) ([]byte, error)
- func (m *UserOwnedDrydockNote) XXX_Merge(src proto.Message)
- func (m *UserOwnedDrydockNote) XXX_Size() int
- func (m *UserOwnedDrydockNote) XXX_Unmarshal(b []byte) error
Constants ¶
This section is empty.
Variables ¶
var AdmissionRule_EnforcementMode_name = map[int32]string{
0: "ENFORCEMENT_MODE_UNSPECIFIED",
1: "ENFORCED_BLOCK_AND_AUDIT_LOG",
2: "DRYRUN_AUDIT_LOG_ONLY",
}
var AdmissionRule_EnforcementMode_value = map[string]int32{
"ENFORCEMENT_MODE_UNSPECIFIED": 0,
"ENFORCED_BLOCK_AND_AUDIT_LOG": 1,
"DRYRUN_AUDIT_LOG_ONLY": 2,
}
var AdmissionRule_EvaluationMode_name = map[int32]string{
0: "EVALUATION_MODE_UNSPECIFIED",
1: "ALWAYS_ALLOW",
2: "REQUIRE_ATTESTATION",
3: "ALWAYS_DENY",
}
var AdmissionRule_EvaluationMode_value = map[string]int32{
"EVALUATION_MODE_UNSPECIFIED": 0,
"ALWAYS_ALLOW": 1,
"REQUIRE_ATTESTATION": 2,
"ALWAYS_DENY": 3,
}
var PkixPublicKey_SignatureAlgorithm_name = map[int32]string{
0: "SIGNATURE_ALGORITHM_UNSPECIFIED",
1: "RSA_PSS_2048_SHA256",
2: "RSA_PSS_3072_SHA256",
3: "RSA_PSS_4096_SHA256",
4: "RSA_PSS_4096_SHA512",
5: "RSA_SIGN_PKCS1_2048_SHA256",
6: "RSA_SIGN_PKCS1_3072_SHA256",
7: "RSA_SIGN_PKCS1_4096_SHA256",
8: "RSA_SIGN_PKCS1_4096_SHA512",
9: "ECDSA_P256_SHA256",
10: "ECDSA_P384_SHA384",
11: "ECDSA_P521_SHA512",
}
var PkixPublicKey_SignatureAlgorithm_value = map[string]int32{
"SIGNATURE_ALGORITHM_UNSPECIFIED": 0,
"RSA_PSS_2048_SHA256": 1,
"RSA_PSS_3072_SHA256": 2,
"RSA_PSS_4096_SHA256": 3,
"RSA_PSS_4096_SHA512": 4,
"RSA_SIGN_PKCS1_2048_SHA256": 5,
"RSA_SIGN_PKCS1_3072_SHA256": 6,
"RSA_SIGN_PKCS1_4096_SHA256": 7,
"RSA_SIGN_PKCS1_4096_SHA512": 8,
"ECDSA_P256_SHA256": 9,
"ECDSA_P384_SHA384": 10,
"ECDSA_P521_SHA512": 11,
}
var Policy_GlobalPolicyEvaluationMode_name = map[int32]string{
0: "GLOBAL_POLICY_EVALUATION_MODE_UNSPECIFIED",
1: "ENABLE",
2: "DISABLE",
}
var Policy_GlobalPolicyEvaluationMode_value = map[string]int32{
"GLOBAL_POLICY_EVALUATION_MODE_UNSPECIFIED": 0,
"ENABLE": 1,
"DISABLE": 2,
}
Functions ¶
func RegisterBinauthzManagementServiceV1Beta1Server ¶
func RegisterBinauthzManagementServiceV1Beta1Server(s *grpc.Server, srv BinauthzManagementServiceV1Beta1Server)
Types ¶
type AdmissionRule ¶
type AdmissionRule struct { // Required. How this admission rule will be evaluated. EvaluationMode AdmissionRule_EvaluationMode `` /* 179-byte string literal not displayed */ // Optional. The resource names of the attestors that must attest to // a container image, in the format `projects/*/attestors/*`. Each // attestor must exist before a policy can reference it. To add an attestor // to a policy the principal issuing the policy change request must be able // to read the attestor resource. // // Note: this field must be non-empty when the evaluation_mode field specifies // REQUIRE_ATTESTATION, otherwise it must be empty. RequireAttestationsBy []string `` /* 126-byte string literal not displayed */ // Required. The action when a pod creation is denied by the admission rule. EnforcementMode AdmissionRule_EnforcementMode `` /* 183-byte string literal not displayed */ XXX_NoUnkeyedLiteral struct{} `json:"-"` XXX_unrecognized []byte `json:"-"` XXX_sizecache int32 `json:"-"` }
An [admission rule][google.cloud.binaryauthorization.v1beta1.AdmissionRule] specifies either that all container images used in a pod creation request must be attested to by one or more [attestors][google.cloud.binaryauthorization.v1beta1.Attestor], that all pod creations will be allowed, or that all pod creations will be denied.
Images matching an [admission whitelist pattern][google.cloud.binaryauthorization.v1beta1.AdmissionWhitelistPattern] are exempted from admission rules and will never block a pod creation.
func (*AdmissionRule) Descriptor ¶
func (*AdmissionRule) Descriptor() ([]byte, []int)
func (*AdmissionRule) GetEnforcementMode ¶
func (m *AdmissionRule) GetEnforcementMode() AdmissionRule_EnforcementMode
func (*AdmissionRule) GetEvaluationMode ¶
func (m *AdmissionRule) GetEvaluationMode() AdmissionRule_EvaluationMode
func (*AdmissionRule) GetRequireAttestationsBy ¶
func (m *AdmissionRule) GetRequireAttestationsBy() []string
func (*AdmissionRule) ProtoMessage ¶
func (*AdmissionRule) ProtoMessage()
func (*AdmissionRule) Reset ¶
func (m *AdmissionRule) Reset()
func (*AdmissionRule) String ¶
func (m *AdmissionRule) String() string
func (*AdmissionRule) XXX_DiscardUnknown ¶
func (m *AdmissionRule) XXX_DiscardUnknown()
func (*AdmissionRule) XXX_Marshal ¶
func (m *AdmissionRule) XXX_Marshal(b []byte, deterministic bool) ([]byte, error)
func (*AdmissionRule) XXX_Merge ¶
func (m *AdmissionRule) XXX_Merge(src proto.Message)
func (*AdmissionRule) XXX_Size ¶
func (m *AdmissionRule) XXX_Size() int
func (*AdmissionRule) XXX_Unmarshal ¶
func (m *AdmissionRule) XXX_Unmarshal(b []byte) error
type AdmissionRule_EnforcementMode ¶
type AdmissionRule_EnforcementMode int32
Defines the possible actions when a pod creation is denied by an admission rule.
const ( // Do not use. AdmissionRule_ENFORCEMENT_MODE_UNSPECIFIED AdmissionRule_EnforcementMode = 0 // Enforce the admission rule by blocking the pod creation. AdmissionRule_ENFORCED_BLOCK_AND_AUDIT_LOG AdmissionRule_EnforcementMode = 1 // Dryrun mode: Audit logging only. This will allow the pod creation as if // the admission request had specified break-glass. AdmissionRule_DRYRUN_AUDIT_LOG_ONLY AdmissionRule_EnforcementMode = 2 )
func (AdmissionRule_EnforcementMode) EnumDescriptor ¶
func (AdmissionRule_EnforcementMode) EnumDescriptor() ([]byte, []int)
func (AdmissionRule_EnforcementMode) String ¶
func (x AdmissionRule_EnforcementMode) String() string
type AdmissionRule_EvaluationMode ¶
type AdmissionRule_EvaluationMode int32
const ( // Do not use. AdmissionRule_EVALUATION_MODE_UNSPECIFIED AdmissionRule_EvaluationMode = 0 // This rule allows all all pod creations. AdmissionRule_ALWAYS_ALLOW AdmissionRule_EvaluationMode = 1 // This rule allows a pod creation if all the attestors listed in // 'require_attestations_by' have valid attestations for all of the // images in the pod spec. AdmissionRule_REQUIRE_ATTESTATION AdmissionRule_EvaluationMode = 2 // This rule denies all pod creations. AdmissionRule_ALWAYS_DENY AdmissionRule_EvaluationMode = 3 )
func (AdmissionRule_EvaluationMode) EnumDescriptor ¶
func (AdmissionRule_EvaluationMode) EnumDescriptor() ([]byte, []int)
func (AdmissionRule_EvaluationMode) String ¶
func (x AdmissionRule_EvaluationMode) String() string
type AdmissionWhitelistPattern ¶
type AdmissionWhitelistPattern struct { // An image name pattern to whitelist, in the form `registry/path/to/image`. // This supports a trailing `*` as a wildcard, but this is allowed only in // text after the `registry/` part. NamePattern string `protobuf:"bytes,1,opt,name=name_pattern,json=namePattern,proto3" json:"name_pattern,omitempty"` XXX_NoUnkeyedLiteral struct{} `json:"-"` XXX_unrecognized []byte `json:"-"` XXX_sizecache int32 `json:"-"` }
An [admission whitelist pattern][google.cloud.binaryauthorization.v1beta1.AdmissionWhitelistPattern] exempts images from checks by [admission rules][google.cloud.binaryauthorization.v1beta1.AdmissionRule].
func (*AdmissionWhitelistPattern) Descriptor ¶
func (*AdmissionWhitelistPattern) Descriptor() ([]byte, []int)
func (*AdmissionWhitelistPattern) GetNamePattern ¶
func (m *AdmissionWhitelistPattern) GetNamePattern() string
func (*AdmissionWhitelistPattern) ProtoMessage ¶
func (*AdmissionWhitelistPattern) ProtoMessage()
func (*AdmissionWhitelistPattern) Reset ¶
func (m *AdmissionWhitelistPattern) Reset()
func (*AdmissionWhitelistPattern) String ¶
func (m *AdmissionWhitelistPattern) String() string
func (*AdmissionWhitelistPattern) XXX_DiscardUnknown ¶
func (m *AdmissionWhitelistPattern) XXX_DiscardUnknown()
func (*AdmissionWhitelistPattern) XXX_Marshal ¶
func (m *AdmissionWhitelistPattern) XXX_Marshal(b []byte, deterministic bool) ([]byte, error)
func (*AdmissionWhitelistPattern) XXX_Merge ¶
func (m *AdmissionWhitelistPattern) XXX_Merge(src proto.Message)
func (*AdmissionWhitelistPattern) XXX_Size ¶
func (m *AdmissionWhitelistPattern) XXX_Size() int
func (*AdmissionWhitelistPattern) XXX_Unmarshal ¶
func (m *AdmissionWhitelistPattern) XXX_Unmarshal(b []byte) error
type Attestor ¶
type Attestor struct { // Required. The resource name, in the format: // `projects/*/attestors/*`. This field may not be updated. Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` // Optional. A descriptive comment. This field may be updated. // The field may be displayed in chooser dialogs. Description string `protobuf:"bytes,6,opt,name=description,proto3" json:"description,omitempty"` // Required. Identifies an [attestor][google.cloud.binaryauthorization.v1beta1.Attestor] that attests to a // container image artifact. This determines how an attestation will // be stored, and how it will be used during policy // enforcement. Updates may not change the attestor type, but individual // attestor fields may be updated // // Types that are valid to be assigned to AttestorType: // *Attestor_UserOwnedDrydockNote AttestorType isAttestor_AttestorType `protobuf_oneof:"attestor_type"` // Output only. Time when the attestor was last updated. UpdateTime *timestamp.Timestamp `protobuf:"bytes,4,opt,name=update_time,json=updateTime,proto3" json:"update_time,omitempty"` XXX_NoUnkeyedLiteral struct{} `json:"-"` XXX_unrecognized []byte `json:"-"` XXX_sizecache int32 `json:"-"` }
An [attestor][google.cloud.binaryauthorization.v1beta1.Attestor] that attests to container image artifacts. An existing attestor cannot be modified except where indicated.
func (*Attestor) Descriptor ¶
func (*Attestor) GetAttestorType ¶
func (m *Attestor) GetAttestorType() isAttestor_AttestorType
func (*Attestor) GetDescription ¶
func (*Attestor) GetUpdateTime ¶
func (*Attestor) GetUserOwnedDrydockNote ¶
func (m *Attestor) GetUserOwnedDrydockNote() *UserOwnedDrydockNote
func (*Attestor) ProtoMessage ¶
func (*Attestor) ProtoMessage()
func (*Attestor) XXX_DiscardUnknown ¶
func (m *Attestor) XXX_DiscardUnknown()
func (*Attestor) XXX_Marshal ¶
func (*Attestor) XXX_OneofWrappers ¶
func (*Attestor) XXX_OneofWrappers() []interface{}
XXX_OneofWrappers is for the internal use of the proto package.
func (*Attestor) XXX_Unmarshal ¶
type AttestorPublicKey ¶
type AttestorPublicKey struct { // Optional. A descriptive comment. This field may be updated. Comment string `protobuf:"bytes,1,opt,name=comment,proto3" json:"comment,omitempty"` // The ID of this public key. // Signatures verified by BinAuthz must include the ID of the public key that // can be used to verify them, and that ID must match the contents of this // field exactly. // Additional restrictions on this field can be imposed based on which public // key type is encapsulated. See the documentation on `public_key` cases below // for details. Id string `protobuf:"bytes,2,opt,name=id,proto3" json:"id,omitempty"` // Required. A public key reference or serialized instance. This field may be // updated. // // Types that are valid to be assigned to PublicKey: // *AttestorPublicKey_AsciiArmoredPgpPublicKey // *AttestorPublicKey_PkixPublicKey PublicKey isAttestorPublicKey_PublicKey `protobuf_oneof:"public_key"` XXX_NoUnkeyedLiteral struct{} `json:"-"` XXX_unrecognized []byte `json:"-"` XXX_sizecache int32 `json:"-"` }
An [attestor public key][google.cloud.binaryauthorization.v1beta1.AttestorPublicKey] that will be used to verify attestations signed by this attestor.
func (*AttestorPublicKey) Descriptor ¶
func (*AttestorPublicKey) Descriptor() ([]byte, []int)
func (*AttestorPublicKey) GetAsciiArmoredPgpPublicKey ¶
func (m *AttestorPublicKey) GetAsciiArmoredPgpPublicKey() string
func (*AttestorPublicKey) GetComment ¶
func (m *AttestorPublicKey) GetComment() string
func (*AttestorPublicKey) GetId ¶
func (m *AttestorPublicKey) GetId() string
func (*AttestorPublicKey) GetPkixPublicKey ¶
func (m *AttestorPublicKey) GetPkixPublicKey() *PkixPublicKey
func (*AttestorPublicKey) GetPublicKey ¶
func (m *AttestorPublicKey) GetPublicKey() isAttestorPublicKey_PublicKey
func (*AttestorPublicKey) ProtoMessage ¶
func (*AttestorPublicKey) ProtoMessage()
func (*AttestorPublicKey) Reset ¶
func (m *AttestorPublicKey) Reset()
func (*AttestorPublicKey) String ¶
func (m *AttestorPublicKey) String() string
func (*AttestorPublicKey) XXX_DiscardUnknown ¶
func (m *AttestorPublicKey) XXX_DiscardUnknown()
func (*AttestorPublicKey) XXX_Marshal ¶
func (m *AttestorPublicKey) XXX_Marshal(b []byte, deterministic bool) ([]byte, error)
func (*AttestorPublicKey) XXX_Merge ¶
func (m *AttestorPublicKey) XXX_Merge(src proto.Message)
func (*AttestorPublicKey) XXX_OneofWrappers ¶
func (*AttestorPublicKey) XXX_OneofWrappers() []interface{}
XXX_OneofWrappers is for the internal use of the proto package.
func (*AttestorPublicKey) XXX_Size ¶
func (m *AttestorPublicKey) XXX_Size() int
func (*AttestorPublicKey) XXX_Unmarshal ¶
func (m *AttestorPublicKey) XXX_Unmarshal(b []byte) error
type AttestorPublicKey_AsciiArmoredPgpPublicKey ¶
type AttestorPublicKey_AsciiArmoredPgpPublicKey struct {
AsciiArmoredPgpPublicKey string `protobuf:"bytes,3,opt,name=ascii_armored_pgp_public_key,json=asciiArmoredPgpPublicKey,proto3,oneof"`
}
type AttestorPublicKey_PkixPublicKey ¶
type AttestorPublicKey_PkixPublicKey struct {
PkixPublicKey *PkixPublicKey `protobuf:"bytes,5,opt,name=pkix_public_key,json=pkixPublicKey,proto3,oneof"`
}
type Attestor_UserOwnedDrydockNote ¶
type Attestor_UserOwnedDrydockNote struct {
UserOwnedDrydockNote *UserOwnedDrydockNote `protobuf:"bytes,3,opt,name=user_owned_drydock_note,json=userOwnedDrydockNote,proto3,oneof"`
}
type BinauthzManagementServiceV1Beta1Client ¶
type BinauthzManagementServiceV1Beta1Client interface { // A [policy][google.cloud.binaryauthorization.v1beta1.Policy] specifies the [attestors][google.cloud.binaryauthorization.v1beta1.Attestor] that must attest to // a container image, before the project is allowed to deploy that // image. There is at most one policy per project. All image admission // requests are permitted if a project has no policy. // // Gets the [policy][google.cloud.binaryauthorization.v1beta1.Policy] for this project. Returns a default // [policy][google.cloud.binaryauthorization.v1beta1.Policy] if the project does not have one. GetPolicy(ctx context.Context, in *GetPolicyRequest, opts ...grpc.CallOption) (*Policy, error) // Creates or updates a project's [policy][google.cloud.binaryauthorization.v1beta1.Policy], and returns a copy of the // new [policy][google.cloud.binaryauthorization.v1beta1.Policy]. A policy is always updated as a whole, to avoid race // conditions with concurrent policy enforcement (or management!) // requests. Returns NOT_FOUND if the project does not exist, INVALID_ARGUMENT // if the request is malformed. UpdatePolicy(ctx context.Context, in *UpdatePolicyRequest, opts ...grpc.CallOption) (*Policy, error) // Creates an [attestor][google.cloud.binaryauthorization.v1beta1.Attestor], and returns a copy of the new // [attestor][google.cloud.binaryauthorization.v1beta1.Attestor]. Returns NOT_FOUND if the project does not exist, // INVALID_ARGUMENT if the request is malformed, ALREADY_EXISTS if the // [attestor][google.cloud.binaryauthorization.v1beta1.Attestor] already exists. CreateAttestor(ctx context.Context, in *CreateAttestorRequest, opts ...grpc.CallOption) (*Attestor, error) // Gets an [attestor][google.cloud.binaryauthorization.v1beta1.Attestor]. // Returns NOT_FOUND if the [attestor][google.cloud.binaryauthorization.v1beta1.Attestor] does not exist. GetAttestor(ctx context.Context, in *GetAttestorRequest, opts ...grpc.CallOption) (*Attestor, error) // Updates an [attestor][google.cloud.binaryauthorization.v1beta1.Attestor]. // Returns NOT_FOUND if the [attestor][google.cloud.binaryauthorization.v1beta1.Attestor] does not exist. UpdateAttestor(ctx context.Context, in *UpdateAttestorRequest, opts ...grpc.CallOption) (*Attestor, error) // Lists [attestors][google.cloud.binaryauthorization.v1beta1.Attestor]. // Returns INVALID_ARGUMENT if the project does not exist. ListAttestors(ctx context.Context, in *ListAttestorsRequest, opts ...grpc.CallOption) (*ListAttestorsResponse, error) // Deletes an [attestor][google.cloud.binaryauthorization.v1beta1.Attestor]. Returns NOT_FOUND if the // [attestor][google.cloud.binaryauthorization.v1beta1.Attestor] does not exist. DeleteAttestor(ctx context.Context, in *DeleteAttestorRequest, opts ...grpc.CallOption) (*empty.Empty, error) }
BinauthzManagementServiceV1Beta1Client is the client API for BinauthzManagementServiceV1Beta1 service.
For semantics around ctx use and closing/ending streaming RPCs, please refer to https://godoc.org/google.golang.org/grpc#ClientConn.NewStream.
func NewBinauthzManagementServiceV1Beta1Client ¶
func NewBinauthzManagementServiceV1Beta1Client(cc grpc.ClientConnInterface) BinauthzManagementServiceV1Beta1Client
type BinauthzManagementServiceV1Beta1Server ¶
type BinauthzManagementServiceV1Beta1Server interface { // A [policy][google.cloud.binaryauthorization.v1beta1.Policy] specifies the [attestors][google.cloud.binaryauthorization.v1beta1.Attestor] that must attest to // a container image, before the project is allowed to deploy that // image. There is at most one policy per project. All image admission // requests are permitted if a project has no policy. // // Gets the [policy][google.cloud.binaryauthorization.v1beta1.Policy] for this project. Returns a default // [policy][google.cloud.binaryauthorization.v1beta1.Policy] if the project does not have one. GetPolicy(context.Context, *GetPolicyRequest) (*Policy, error) // Creates or updates a project's [policy][google.cloud.binaryauthorization.v1beta1.Policy], and returns a copy of the // new [policy][google.cloud.binaryauthorization.v1beta1.Policy]. A policy is always updated as a whole, to avoid race // conditions with concurrent policy enforcement (or management!) // requests. Returns NOT_FOUND if the project does not exist, INVALID_ARGUMENT // if the request is malformed. UpdatePolicy(context.Context, *UpdatePolicyRequest) (*Policy, error) // Creates an [attestor][google.cloud.binaryauthorization.v1beta1.Attestor], and returns a copy of the new // [attestor][google.cloud.binaryauthorization.v1beta1.Attestor]. Returns NOT_FOUND if the project does not exist, // INVALID_ARGUMENT if the request is malformed, ALREADY_EXISTS if the // [attestor][google.cloud.binaryauthorization.v1beta1.Attestor] already exists. CreateAttestor(context.Context, *CreateAttestorRequest) (*Attestor, error) // Gets an [attestor][google.cloud.binaryauthorization.v1beta1.Attestor]. // Returns NOT_FOUND if the [attestor][google.cloud.binaryauthorization.v1beta1.Attestor] does not exist. GetAttestor(context.Context, *GetAttestorRequest) (*Attestor, error) // Updates an [attestor][google.cloud.binaryauthorization.v1beta1.Attestor]. // Returns NOT_FOUND if the [attestor][google.cloud.binaryauthorization.v1beta1.Attestor] does not exist. UpdateAttestor(context.Context, *UpdateAttestorRequest) (*Attestor, error) // Lists [attestors][google.cloud.binaryauthorization.v1beta1.Attestor]. // Returns INVALID_ARGUMENT if the project does not exist. ListAttestors(context.Context, *ListAttestorsRequest) (*ListAttestorsResponse, error) // Deletes an [attestor][google.cloud.binaryauthorization.v1beta1.Attestor]. Returns NOT_FOUND if the // [attestor][google.cloud.binaryauthorization.v1beta1.Attestor] does not exist. DeleteAttestor(context.Context, *DeleteAttestorRequest) (*empty.Empty, error) }
BinauthzManagementServiceV1Beta1Server is the server API for BinauthzManagementServiceV1Beta1 service.
type CreateAttestorRequest ¶
type CreateAttestorRequest struct { // Required. The parent of this [attestor][google.cloud.binaryauthorization.v1beta1.Attestor]. Parent string `protobuf:"bytes,1,opt,name=parent,proto3" json:"parent,omitempty"` // Required. The [attestors][google.cloud.binaryauthorization.v1beta1.Attestor] ID. AttestorId string `protobuf:"bytes,2,opt,name=attestor_id,json=attestorId,proto3" json:"attestor_id,omitempty"` // Required. The initial [attestor][google.cloud.binaryauthorization.v1beta1.Attestor] value. The service will // overwrite the [attestor name][google.cloud.binaryauthorization.v1beta1.Attestor.name] field with the resource name, // in the format `projects/*/attestors/*`. Attestor *Attestor `protobuf:"bytes,3,opt,name=attestor,proto3" json:"attestor,omitempty"` XXX_NoUnkeyedLiteral struct{} `json:"-"` XXX_unrecognized []byte `json:"-"` XXX_sizecache int32 `json:"-"` }
Request message for [BinauthzManagementService.CreateAttestor][].
func (*CreateAttestorRequest) Descriptor ¶
func (*CreateAttestorRequest) Descriptor() ([]byte, []int)
func (*CreateAttestorRequest) GetAttestor ¶
func (m *CreateAttestorRequest) GetAttestor() *Attestor
func (*CreateAttestorRequest) GetAttestorId ¶
func (m *CreateAttestorRequest) GetAttestorId() string
func (*CreateAttestorRequest) GetParent ¶
func (m *CreateAttestorRequest) GetParent() string
func (*CreateAttestorRequest) ProtoMessage ¶
func (*CreateAttestorRequest) ProtoMessage()
func (*CreateAttestorRequest) Reset ¶
func (m *CreateAttestorRequest) Reset()
func (*CreateAttestorRequest) String ¶
func (m *CreateAttestorRequest) String() string
func (*CreateAttestorRequest) XXX_DiscardUnknown ¶
func (m *CreateAttestorRequest) XXX_DiscardUnknown()
func (*CreateAttestorRequest) XXX_Marshal ¶
func (m *CreateAttestorRequest) XXX_Marshal(b []byte, deterministic bool) ([]byte, error)
func (*CreateAttestorRequest) XXX_Merge ¶
func (m *CreateAttestorRequest) XXX_Merge(src proto.Message)
func (*CreateAttestorRequest) XXX_Size ¶
func (m *CreateAttestorRequest) XXX_Size() int
func (*CreateAttestorRequest) XXX_Unmarshal ¶
func (m *CreateAttestorRequest) XXX_Unmarshal(b []byte) error
type DeleteAttestorRequest ¶
type DeleteAttestorRequest struct { // Required. The name of the [attestors][google.cloud.binaryauthorization.v1beta1.Attestor] to delete, in the format // `projects/*/attestors/*`. Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` XXX_NoUnkeyedLiteral struct{} `json:"-"` XXX_unrecognized []byte `json:"-"` XXX_sizecache int32 `json:"-"` }
Request message for [BinauthzManagementService.DeleteAttestor][].
func (*DeleteAttestorRequest) Descriptor ¶
func (*DeleteAttestorRequest) Descriptor() ([]byte, []int)
func (*DeleteAttestorRequest) GetName ¶
func (m *DeleteAttestorRequest) GetName() string
func (*DeleteAttestorRequest) ProtoMessage ¶
func (*DeleteAttestorRequest) ProtoMessage()
func (*DeleteAttestorRequest) Reset ¶
func (m *DeleteAttestorRequest) Reset()
func (*DeleteAttestorRequest) String ¶
func (m *DeleteAttestorRequest) String() string
func (*DeleteAttestorRequest) XXX_DiscardUnknown ¶
func (m *DeleteAttestorRequest) XXX_DiscardUnknown()
func (*DeleteAttestorRequest) XXX_Marshal ¶
func (m *DeleteAttestorRequest) XXX_Marshal(b []byte, deterministic bool) ([]byte, error)
func (*DeleteAttestorRequest) XXX_Merge ¶
func (m *DeleteAttestorRequest) XXX_Merge(src proto.Message)
func (*DeleteAttestorRequest) XXX_Size ¶
func (m *DeleteAttestorRequest) XXX_Size() int
func (*DeleteAttestorRequest) XXX_Unmarshal ¶
func (m *DeleteAttestorRequest) XXX_Unmarshal(b []byte) error
type GetAttestorRequest ¶
type GetAttestorRequest struct { // Required. The name of the [attestor][google.cloud.binaryauthorization.v1beta1.Attestor] to retrieve, in the format // `projects/*/attestors/*`. Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` XXX_NoUnkeyedLiteral struct{} `json:"-"` XXX_unrecognized []byte `json:"-"` XXX_sizecache int32 `json:"-"` }
Request message for [BinauthzManagementService.GetAttestor][].
func (*GetAttestorRequest) Descriptor ¶
func (*GetAttestorRequest) Descriptor() ([]byte, []int)
func (*GetAttestorRequest) GetName ¶
func (m *GetAttestorRequest) GetName() string
func (*GetAttestorRequest) ProtoMessage ¶
func (*GetAttestorRequest) ProtoMessage()
func (*GetAttestorRequest) Reset ¶
func (m *GetAttestorRequest) Reset()
func (*GetAttestorRequest) String ¶
func (m *GetAttestorRequest) String() string
func (*GetAttestorRequest) XXX_DiscardUnknown ¶
func (m *GetAttestorRequest) XXX_DiscardUnknown()
func (*GetAttestorRequest) XXX_Marshal ¶
func (m *GetAttestorRequest) XXX_Marshal(b []byte, deterministic bool) ([]byte, error)
func (*GetAttestorRequest) XXX_Merge ¶
func (m *GetAttestorRequest) XXX_Merge(src proto.Message)
func (*GetAttestorRequest) XXX_Size ¶
func (m *GetAttestorRequest) XXX_Size() int
func (*GetAttestorRequest) XXX_Unmarshal ¶
func (m *GetAttestorRequest) XXX_Unmarshal(b []byte) error
type GetPolicyRequest ¶
type GetPolicyRequest struct { // Required. The resource name of the [policy][google.cloud.binaryauthorization.v1beta1.Policy] to retrieve, // in the format `projects/*/policy`. Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` XXX_NoUnkeyedLiteral struct{} `json:"-"` XXX_unrecognized []byte `json:"-"` XXX_sizecache int32 `json:"-"` }
Request message for [BinauthzManagementService.GetPolicy][].
func (*GetPolicyRequest) Descriptor ¶
func (*GetPolicyRequest) Descriptor() ([]byte, []int)
func (*GetPolicyRequest) GetName ¶
func (m *GetPolicyRequest) GetName() string
func (*GetPolicyRequest) ProtoMessage ¶
func (*GetPolicyRequest) ProtoMessage()
func (*GetPolicyRequest) Reset ¶
func (m *GetPolicyRequest) Reset()
func (*GetPolicyRequest) String ¶
func (m *GetPolicyRequest) String() string
func (*GetPolicyRequest) XXX_DiscardUnknown ¶
func (m *GetPolicyRequest) XXX_DiscardUnknown()
func (*GetPolicyRequest) XXX_Marshal ¶
func (m *GetPolicyRequest) XXX_Marshal(b []byte, deterministic bool) ([]byte, error)
func (*GetPolicyRequest) XXX_Merge ¶
func (m *GetPolicyRequest) XXX_Merge(src proto.Message)
func (*GetPolicyRequest) XXX_Size ¶
func (m *GetPolicyRequest) XXX_Size() int
func (*GetPolicyRequest) XXX_Unmarshal ¶
func (m *GetPolicyRequest) XXX_Unmarshal(b []byte) error
type ListAttestorsRequest ¶
type ListAttestorsRequest struct { // Required. The resource name of the project associated with the // [attestors][google.cloud.binaryauthorization.v1beta1.Attestor], in the format `projects/*`. Parent string `protobuf:"bytes,1,opt,name=parent,proto3" json:"parent,omitempty"` // Requested page size. The server may return fewer results than requested. If // unspecified, the server will pick an appropriate default. PageSize int32 `protobuf:"varint,2,opt,name=page_size,json=pageSize,proto3" json:"page_size,omitempty"` // A token identifying a page of results the server should return. Typically, // this is the value of [ListAttestorsResponse.next_page_token][google.cloud.binaryauthorization.v1beta1.ListAttestorsResponse.next_page_token] returned // from the previous call to the `ListAttestors` method. PageToken string `protobuf:"bytes,3,opt,name=page_token,json=pageToken,proto3" json:"page_token,omitempty"` XXX_NoUnkeyedLiteral struct{} `json:"-"` XXX_unrecognized []byte `json:"-"` XXX_sizecache int32 `json:"-"` }
Request message for [BinauthzManagementService.ListAttestors][].
func (*ListAttestorsRequest) Descriptor ¶
func (*ListAttestorsRequest) Descriptor() ([]byte, []int)
func (*ListAttestorsRequest) GetPageSize ¶
func (m *ListAttestorsRequest) GetPageSize() int32
func (*ListAttestorsRequest) GetPageToken ¶
func (m *ListAttestorsRequest) GetPageToken() string
func (*ListAttestorsRequest) GetParent ¶
func (m *ListAttestorsRequest) GetParent() string
func (*ListAttestorsRequest) ProtoMessage ¶
func (*ListAttestorsRequest) ProtoMessage()
func (*ListAttestorsRequest) Reset ¶
func (m *ListAttestorsRequest) Reset()
func (*ListAttestorsRequest) String ¶
func (m *ListAttestorsRequest) String() string
func (*ListAttestorsRequest) XXX_DiscardUnknown ¶
func (m *ListAttestorsRequest) XXX_DiscardUnknown()
func (*ListAttestorsRequest) XXX_Marshal ¶
func (m *ListAttestorsRequest) XXX_Marshal(b []byte, deterministic bool) ([]byte, error)
func (*ListAttestorsRequest) XXX_Merge ¶
func (m *ListAttestorsRequest) XXX_Merge(src proto.Message)
func (*ListAttestorsRequest) XXX_Size ¶
func (m *ListAttestorsRequest) XXX_Size() int
func (*ListAttestorsRequest) XXX_Unmarshal ¶
func (m *ListAttestorsRequest) XXX_Unmarshal(b []byte) error
type ListAttestorsResponse ¶
type ListAttestorsResponse struct { // The list of [attestors][google.cloud.binaryauthorization.v1beta1.Attestor]. Attestors []*Attestor `protobuf:"bytes,1,rep,name=attestors,proto3" json:"attestors,omitempty"` // A token to retrieve the next page of results. Pass this value in the // [ListAttestorsRequest.page_token][google.cloud.binaryauthorization.v1beta1.ListAttestorsRequest.page_token] field in the subsequent call to the // `ListAttestors` method to retrieve the next page of results. NextPageToken string `protobuf:"bytes,2,opt,name=next_page_token,json=nextPageToken,proto3" json:"next_page_token,omitempty"` XXX_NoUnkeyedLiteral struct{} `json:"-"` XXX_unrecognized []byte `json:"-"` XXX_sizecache int32 `json:"-"` }
Response message for [BinauthzManagementService.ListAttestors][].
func (*ListAttestorsResponse) Descriptor ¶
func (*ListAttestorsResponse) Descriptor() ([]byte, []int)
func (*ListAttestorsResponse) GetAttestors ¶
func (m *ListAttestorsResponse) GetAttestors() []*Attestor
func (*ListAttestorsResponse) GetNextPageToken ¶
func (m *ListAttestorsResponse) GetNextPageToken() string
func (*ListAttestorsResponse) ProtoMessage ¶
func (*ListAttestorsResponse) ProtoMessage()
func (*ListAttestorsResponse) Reset ¶
func (m *ListAttestorsResponse) Reset()
func (*ListAttestorsResponse) String ¶
func (m *ListAttestorsResponse) String() string
func (*ListAttestorsResponse) XXX_DiscardUnknown ¶
func (m *ListAttestorsResponse) XXX_DiscardUnknown()
func (*ListAttestorsResponse) XXX_Marshal ¶
func (m *ListAttestorsResponse) XXX_Marshal(b []byte, deterministic bool) ([]byte, error)
func (*ListAttestorsResponse) XXX_Merge ¶
func (m *ListAttestorsResponse) XXX_Merge(src proto.Message)
func (*ListAttestorsResponse) XXX_Size ¶
func (m *ListAttestorsResponse) XXX_Size() int
func (*ListAttestorsResponse) XXX_Unmarshal ¶
func (m *ListAttestorsResponse) XXX_Unmarshal(b []byte) error
type PkixPublicKey ¶
type PkixPublicKey struct { // A PEM-encoded public key, as described in // https://tools.ietf.org/html/rfc7468#section-13 PublicKeyPem string `protobuf:"bytes,1,opt,name=public_key_pem,json=publicKeyPem,proto3" json:"public_key_pem,omitempty"` // The signature algorithm used to verify a message against a signature using // this key. // These signature algorithm must match the structure and any object // identifiers encoded in `public_key_pem` (i.e. this algorithm must match // that of the public key). SignatureAlgorithm PkixPublicKey_SignatureAlgorithm `` /* 195-byte string literal not displayed */ XXX_NoUnkeyedLiteral struct{} `json:"-"` XXX_unrecognized []byte `json:"-"` XXX_sizecache int32 `json:"-"` }
A public key in the PkixPublicKey format (see https://tools.ietf.org/html/rfc5280#section-4.1.2.7 for details). Public keys of this type are typically textually encoded using the PEM format.
func (*PkixPublicKey) Descriptor ¶
func (*PkixPublicKey) Descriptor() ([]byte, []int)
func (*PkixPublicKey) GetPublicKeyPem ¶
func (m *PkixPublicKey) GetPublicKeyPem() string
func (*PkixPublicKey) GetSignatureAlgorithm ¶
func (m *PkixPublicKey) GetSignatureAlgorithm() PkixPublicKey_SignatureAlgorithm
func (*PkixPublicKey) ProtoMessage ¶
func (*PkixPublicKey) ProtoMessage()
func (*PkixPublicKey) Reset ¶
func (m *PkixPublicKey) Reset()
func (*PkixPublicKey) String ¶
func (m *PkixPublicKey) String() string
func (*PkixPublicKey) XXX_DiscardUnknown ¶
func (m *PkixPublicKey) XXX_DiscardUnknown()
func (*PkixPublicKey) XXX_Marshal ¶
func (m *PkixPublicKey) XXX_Marshal(b []byte, deterministic bool) ([]byte, error)
func (*PkixPublicKey) XXX_Merge ¶
func (m *PkixPublicKey) XXX_Merge(src proto.Message)
func (*PkixPublicKey) XXX_Size ¶
func (m *PkixPublicKey) XXX_Size() int
func (*PkixPublicKey) XXX_Unmarshal ¶
func (m *PkixPublicKey) XXX_Unmarshal(b []byte) error
type PkixPublicKey_SignatureAlgorithm ¶
type PkixPublicKey_SignatureAlgorithm int32
Represents a signature algorithm and other information necessary to verify signatures with a given public key. This is based primarily on the public key types supported by Tink's PemKeyType, which is in turn based on KMS's supported signing algorithms. See https://cloud.google.com/kms/docs/algorithms. In the future, BinAuthz might support additional public key types independently of Tink and/or KMS.
const ( // Not specified. PkixPublicKey_SIGNATURE_ALGORITHM_UNSPECIFIED PkixPublicKey_SignatureAlgorithm = 0 // RSASSA-PSS 2048 bit key with a SHA256 digest. PkixPublicKey_RSA_PSS_2048_SHA256 PkixPublicKey_SignatureAlgorithm = 1 // RSASSA-PSS 3072 bit key with a SHA256 digest. PkixPublicKey_RSA_PSS_3072_SHA256 PkixPublicKey_SignatureAlgorithm = 2 // RSASSA-PSS 4096 bit key with a SHA256 digest. PkixPublicKey_RSA_PSS_4096_SHA256 PkixPublicKey_SignatureAlgorithm = 3 // RSASSA-PSS 4096 bit key with a SHA512 digest. PkixPublicKey_RSA_PSS_4096_SHA512 PkixPublicKey_SignatureAlgorithm = 4 // RSASSA-PKCS1-v1_5 with a 2048 bit key and a SHA256 digest. PkixPublicKey_RSA_SIGN_PKCS1_2048_SHA256 PkixPublicKey_SignatureAlgorithm = 5 // RSASSA-PKCS1-v1_5 with a 3072 bit key and a SHA256 digest. PkixPublicKey_RSA_SIGN_PKCS1_3072_SHA256 PkixPublicKey_SignatureAlgorithm = 6 // RSASSA-PKCS1-v1_5 with a 4096 bit key and a SHA256 digest. PkixPublicKey_RSA_SIGN_PKCS1_4096_SHA256 PkixPublicKey_SignatureAlgorithm = 7 // RSASSA-PKCS1-v1_5 with a 4096 bit key and a SHA512 digest. PkixPublicKey_RSA_SIGN_PKCS1_4096_SHA512 PkixPublicKey_SignatureAlgorithm = 8 // ECDSA on the NIST P-256 curve with a SHA256 digest. PkixPublicKey_ECDSA_P256_SHA256 PkixPublicKey_SignatureAlgorithm = 9 // ECDSA on the NIST P-384 curve with a SHA384 digest. PkixPublicKey_ECDSA_P384_SHA384 PkixPublicKey_SignatureAlgorithm = 10 // ECDSA on the NIST P-521 curve with a SHA512 digest. PkixPublicKey_ECDSA_P521_SHA512 PkixPublicKey_SignatureAlgorithm = 11 )
func (PkixPublicKey_SignatureAlgorithm) EnumDescriptor ¶
func (PkixPublicKey_SignatureAlgorithm) EnumDescriptor() ([]byte, []int)
func (PkixPublicKey_SignatureAlgorithm) String ¶
func (x PkixPublicKey_SignatureAlgorithm) String() string
type Policy ¶
type Policy struct { // Output only. The resource name, in the format `projects/*/policy`. There is // at most one policy per project. Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` // Optional. A descriptive comment. Description string `protobuf:"bytes,6,opt,name=description,proto3" json:"description,omitempty"` // Optional. Controls the evaluation of a Google-maintained global admission // policy for common system-level images. Images not covered by the global // policy will be subject to the project admission policy. This setting // has no effect when specified inside a global admission policy. GlobalPolicyEvaluationMode Policy_GlobalPolicyEvaluationMode `` /* 224-byte string literal not displayed */ // Optional. Admission policy whitelisting. A matching admission request will // always be permitted. This feature is typically used to exclude Google or // third-party infrastructure images from Binary Authorization policies. AdmissionWhitelistPatterns []*AdmissionWhitelistPattern `` /* 141-byte string literal not displayed */ // Optional. Per-cluster admission rules. Cluster spec format: // `location.clusterId`. There can be at most one admission rule per cluster // spec. // A `location` is either a compute zone (e.g. us-central1-a) or a region // (e.g. us-central1). // For `clusterId` syntax restrictions see // https://cloud.google.com/container-engine/reference/rest/v1/projects.zones.clusters. ClusterAdmissionRules map[string]*AdmissionRule `` /* 214-byte string literal not displayed */ // Required. Default admission rule for a cluster without a per-cluster, per- // kubernetes-service-account, or per-istio-service-identity admission rule. DefaultAdmissionRule *AdmissionRule `protobuf:"bytes,4,opt,name=default_admission_rule,json=defaultAdmissionRule,proto3" json:"default_admission_rule,omitempty"` // Output only. Time when the policy was last updated. UpdateTime *timestamp.Timestamp `protobuf:"bytes,5,opt,name=update_time,json=updateTime,proto3" json:"update_time,omitempty"` XXX_NoUnkeyedLiteral struct{} `json:"-"` XXX_unrecognized []byte `json:"-"` XXX_sizecache int32 `json:"-"` }
A [policy][google.cloud.binaryauthorization.v1beta1.Policy] for container image binary authorization.
func (*Policy) Descriptor ¶
func (*Policy) GetAdmissionWhitelistPatterns ¶
func (m *Policy) GetAdmissionWhitelistPatterns() []*AdmissionWhitelistPattern
func (*Policy) GetClusterAdmissionRules ¶
func (m *Policy) GetClusterAdmissionRules() map[string]*AdmissionRule
func (*Policy) GetDefaultAdmissionRule ¶
func (m *Policy) GetDefaultAdmissionRule() *AdmissionRule
func (*Policy) GetDescription ¶
func (*Policy) GetGlobalPolicyEvaluationMode ¶
func (m *Policy) GetGlobalPolicyEvaluationMode() Policy_GlobalPolicyEvaluationMode
func (*Policy) GetUpdateTime ¶
func (*Policy) ProtoMessage ¶
func (*Policy) ProtoMessage()
func (*Policy) XXX_DiscardUnknown ¶
func (m *Policy) XXX_DiscardUnknown()
func (*Policy) XXX_Marshal ¶
func (*Policy) XXX_Unmarshal ¶
type Policy_GlobalPolicyEvaluationMode ¶
type Policy_GlobalPolicyEvaluationMode int32
const ( // Not specified: DISABLE is assumed. Policy_GLOBAL_POLICY_EVALUATION_MODE_UNSPECIFIED Policy_GlobalPolicyEvaluationMode = 0 // Enables global policy evaluation. Policy_ENABLE Policy_GlobalPolicyEvaluationMode = 1 // Disables global policy evaluation. Policy_DISABLE Policy_GlobalPolicyEvaluationMode = 2 )
func (Policy_GlobalPolicyEvaluationMode) EnumDescriptor ¶
func (Policy_GlobalPolicyEvaluationMode) EnumDescriptor() ([]byte, []int)
func (Policy_GlobalPolicyEvaluationMode) String ¶
func (x Policy_GlobalPolicyEvaluationMode) String() string
type UnimplementedBinauthzManagementServiceV1Beta1Server ¶
type UnimplementedBinauthzManagementServiceV1Beta1Server struct { }
UnimplementedBinauthzManagementServiceV1Beta1Server can be embedded to have forward compatible implementations.
func (*UnimplementedBinauthzManagementServiceV1Beta1Server) CreateAttestor ¶
func (*UnimplementedBinauthzManagementServiceV1Beta1Server) CreateAttestor(ctx context.Context, req *CreateAttestorRequest) (*Attestor, error)
func (*UnimplementedBinauthzManagementServiceV1Beta1Server) DeleteAttestor ¶
func (*UnimplementedBinauthzManagementServiceV1Beta1Server) DeleteAttestor(ctx context.Context, req *DeleteAttestorRequest) (*empty.Empty, error)
func (*UnimplementedBinauthzManagementServiceV1Beta1Server) GetAttestor ¶
func (*UnimplementedBinauthzManagementServiceV1Beta1Server) GetAttestor(ctx context.Context, req *GetAttestorRequest) (*Attestor, error)
func (*UnimplementedBinauthzManagementServiceV1Beta1Server) GetPolicy ¶
func (*UnimplementedBinauthzManagementServiceV1Beta1Server) GetPolicy(ctx context.Context, req *GetPolicyRequest) (*Policy, error)
func (*UnimplementedBinauthzManagementServiceV1Beta1Server) ListAttestors ¶
func (*UnimplementedBinauthzManagementServiceV1Beta1Server) ListAttestors(ctx context.Context, req *ListAttestorsRequest) (*ListAttestorsResponse, error)
func (*UnimplementedBinauthzManagementServiceV1Beta1Server) UpdateAttestor ¶
func (*UnimplementedBinauthzManagementServiceV1Beta1Server) UpdateAttestor(ctx context.Context, req *UpdateAttestorRequest) (*Attestor, error)
func (*UnimplementedBinauthzManagementServiceV1Beta1Server) UpdatePolicy ¶
func (*UnimplementedBinauthzManagementServiceV1Beta1Server) UpdatePolicy(ctx context.Context, req *UpdatePolicyRequest) (*Policy, error)
type UpdateAttestorRequest ¶
type UpdateAttestorRequest struct { // Required. The updated [attestor][google.cloud.binaryauthorization.v1beta1.Attestor] value. The service will // overwrite the [attestor name][google.cloud.binaryauthorization.v1beta1.Attestor.name] field with the resource name // in the request URL, in the format `projects/*/attestors/*`. Attestor *Attestor `protobuf:"bytes,1,opt,name=attestor,proto3" json:"attestor,omitempty"` XXX_NoUnkeyedLiteral struct{} `json:"-"` XXX_unrecognized []byte `json:"-"` XXX_sizecache int32 `json:"-"` }
Request message for [BinauthzManagementService.UpdateAttestor][].
func (*UpdateAttestorRequest) Descriptor ¶
func (*UpdateAttestorRequest) Descriptor() ([]byte, []int)
func (*UpdateAttestorRequest) GetAttestor ¶
func (m *UpdateAttestorRequest) GetAttestor() *Attestor
func (*UpdateAttestorRequest) ProtoMessage ¶
func (*UpdateAttestorRequest) ProtoMessage()
func (*UpdateAttestorRequest) Reset ¶
func (m *UpdateAttestorRequest) Reset()
func (*UpdateAttestorRequest) String ¶
func (m *UpdateAttestorRequest) String() string
func (*UpdateAttestorRequest) XXX_DiscardUnknown ¶
func (m *UpdateAttestorRequest) XXX_DiscardUnknown()
func (*UpdateAttestorRequest) XXX_Marshal ¶
func (m *UpdateAttestorRequest) XXX_Marshal(b []byte, deterministic bool) ([]byte, error)
func (*UpdateAttestorRequest) XXX_Merge ¶
func (m *UpdateAttestorRequest) XXX_Merge(src proto.Message)
func (*UpdateAttestorRequest) XXX_Size ¶
func (m *UpdateAttestorRequest) XXX_Size() int
func (*UpdateAttestorRequest) XXX_Unmarshal ¶
func (m *UpdateAttestorRequest) XXX_Unmarshal(b []byte) error
type UpdatePolicyRequest ¶
type UpdatePolicyRequest struct { // Required. A new or updated [policy][google.cloud.binaryauthorization.v1beta1.Policy] value. The service will // overwrite the [policy name][google.cloud.binaryauthorization.v1beta1.Policy.name] field with the resource name in // the request URL, in the format `projects/*/policy`. Policy *Policy `protobuf:"bytes,1,opt,name=policy,proto3" json:"policy,omitempty"` XXX_NoUnkeyedLiteral struct{} `json:"-"` XXX_unrecognized []byte `json:"-"` XXX_sizecache int32 `json:"-"` }
Request message for [BinauthzManagementService.UpdatePolicy][].
func (*UpdatePolicyRequest) Descriptor ¶
func (*UpdatePolicyRequest) Descriptor() ([]byte, []int)
func (*UpdatePolicyRequest) GetPolicy ¶
func (m *UpdatePolicyRequest) GetPolicy() *Policy
func (*UpdatePolicyRequest) ProtoMessage ¶
func (*UpdatePolicyRequest) ProtoMessage()
func (*UpdatePolicyRequest) Reset ¶
func (m *UpdatePolicyRequest) Reset()
func (*UpdatePolicyRequest) String ¶
func (m *UpdatePolicyRequest) String() string
func (*UpdatePolicyRequest) XXX_DiscardUnknown ¶
func (m *UpdatePolicyRequest) XXX_DiscardUnknown()
func (*UpdatePolicyRequest) XXX_Marshal ¶
func (m *UpdatePolicyRequest) XXX_Marshal(b []byte, deterministic bool) ([]byte, error)
func (*UpdatePolicyRequest) XXX_Merge ¶
func (m *UpdatePolicyRequest) XXX_Merge(src proto.Message)
func (*UpdatePolicyRequest) XXX_Size ¶
func (m *UpdatePolicyRequest) XXX_Size() int
func (*UpdatePolicyRequest) XXX_Unmarshal ¶
func (m *UpdatePolicyRequest) XXX_Unmarshal(b []byte) error
type UserOwnedDrydockNote ¶
type UserOwnedDrydockNote struct { // Required. The Drydock resource name of a ATTESTATION_AUTHORITY Note, // created by the user, in the format: `projects/*/notes/*` (or the legacy // `providers/*/notes/*`). This field may not be updated. // // An attestation by this attestor is stored as a Drydock // ATTESTATION_AUTHORITY Occurrence that names a container image and that // links to this Note. Drydock is an external dependency. NoteReference string `protobuf:"bytes,1,opt,name=note_reference,json=noteReference,proto3" json:"note_reference,omitempty"` // Optional. Public keys that verify attestations signed by this // attestor. This field may be updated. // // If this field is non-empty, one of the specified public keys must // verify that an attestation was signed by this attestor for the // image specified in the admission request. // // If this field is empty, this attestor always returns that no // valid attestations exist. PublicKeys []*AttestorPublicKey `protobuf:"bytes,2,rep,name=public_keys,json=publicKeys,proto3" json:"public_keys,omitempty"` // Output only. This field will contain the service account email address // that this Attestor will use as the principal when querying Container // Analysis. Attestor administrators must grant this service account the // IAM role needed to read attestations from the [note_reference][Note] in // Container Analysis (`containeranalysis.notes.occurrences.viewer`). // // This email address is fixed for the lifetime of the Attestor, but callers // should not make any other assumptions about the service account email; // future versions may use an email based on a different naming pattern. DelegationServiceAccountEmail string `` /* 152-byte string literal not displayed */ XXX_NoUnkeyedLiteral struct{} `json:"-"` XXX_unrecognized []byte `json:"-"` XXX_sizecache int32 `json:"-"` }
An [user owned drydock note][google.cloud.binaryauthorization.v1beta1.UserOwnedDrydockNote] references a Drydock ATTESTATION_AUTHORITY Note created by the user.
func (*UserOwnedDrydockNote) Descriptor ¶
func (*UserOwnedDrydockNote) Descriptor() ([]byte, []int)
func (*UserOwnedDrydockNote) GetDelegationServiceAccountEmail ¶
func (m *UserOwnedDrydockNote) GetDelegationServiceAccountEmail() string
func (*UserOwnedDrydockNote) GetNoteReference ¶
func (m *UserOwnedDrydockNote) GetNoteReference() string
func (*UserOwnedDrydockNote) GetPublicKeys ¶
func (m *UserOwnedDrydockNote) GetPublicKeys() []*AttestorPublicKey
func (*UserOwnedDrydockNote) ProtoMessage ¶
func (*UserOwnedDrydockNote) ProtoMessage()
func (*UserOwnedDrydockNote) Reset ¶
func (m *UserOwnedDrydockNote) Reset()
func (*UserOwnedDrydockNote) String ¶
func (m *UserOwnedDrydockNote) String() string
func (*UserOwnedDrydockNote) XXX_DiscardUnknown ¶
func (m *UserOwnedDrydockNote) XXX_DiscardUnknown()
func (*UserOwnedDrydockNote) XXX_Marshal ¶
func (m *UserOwnedDrydockNote) XXX_Marshal(b []byte, deterministic bool) ([]byte, error)
func (*UserOwnedDrydockNote) XXX_Merge ¶
func (m *UserOwnedDrydockNote) XXX_Merge(src proto.Message)
func (*UserOwnedDrydockNote) XXX_Size ¶
func (m *UserOwnedDrydockNote) XXX_Size() int
func (*UserOwnedDrydockNote) XXX_Unmarshal ¶
func (m *UserOwnedDrydockNote) XXX_Unmarshal(b []byte) error