googleBinaryAuthorizationPolicy

A policy for container image binary authorization.

To get more information about Policy, see:

Example Usage - Binary Authorization Policy Basic

/*Provider bindings are generated by running cdktf get.
See https://cdk.tf/provider-generation for more details.*/
import * as google from "./.gen/providers/google";
/*The following providers are missing schema information and might need manual adjustments to synthesize correctly: google.
For a more precise conversion please use the --provider flag in convert.*/
const googleContainerAnalysisNoteNote =
  new google.containerAnalysisNote.ContainerAnalysisNote(this, "note", {
    attestation_authority: [
      {
        hint: [
          {
            human_readable_name: "My attestor",
          },
        ],
      },
    ],
    name: "test-attestor-note",
  });
const googleBinaryAuthorizationAttestorAttestor =
  new google.binaryAuthorizationAttestor.BinaryAuthorizationAttestor(
    this,
    "attestor",
    {
      attestation_authority_note: [
        {
          note_reference: googleContainerAnalysisNoteNote.name,
        },
      ],
      name: "test-attestor",
    }
  );
new google.binaryAuthorizationPolicy.BinaryAuthorizationPolicy(this, "policy", {
  admission_whitelist_patterns: [
    {
      name_pattern: "gcr.io/google_containers/*",
    },
  ],
  cluster_admission_rules: [
    {
      cluster: "us-central1-a.prod-cluster",
      enforcement_mode: "ENFORCED_BLOCK_AND_AUDIT_LOG",
      evaluation_mode: "REQUIRE_ATTESTATION",
      require_attestations_by: [googleBinaryAuthorizationAttestorAttestor.name],
    },
  ],
  default_admission_rule: [
    {
      enforcement_mode: "ENFORCED_BLOCK_AND_AUDIT_LOG",
      evaluation_mode: "ALWAYS_ALLOW",
    },
  ],
});

Example Usage - Binary Authorization Policy Global Evaluation

/*Provider bindings are generated by running cdktf get.
See https://cdk.tf/provider-generation for more details.*/
import * as google from "./.gen/providers/google";
/*The following providers are missing schema information and might need manual adjustments to synthesize correctly: google.
For a more precise conversion please use the --provider flag in convert.*/
const googleContainerAnalysisNoteNote =
  new google.containerAnalysisNote.ContainerAnalysisNote(this, "note", {
    attestation_authority: [
      {
        hint: [
          {
            human_readable_name: "My attestor",
          },
        ],
      },
    ],
    name: "test-attestor-note",
  });
const googleBinaryAuthorizationAttestorAttestor =
  new google.binaryAuthorizationAttestor.BinaryAuthorizationAttestor(
    this,
    "attestor",
    {
      attestation_authority_note: [
        {
          note_reference: googleContainerAnalysisNoteNote.name,
        },
      ],
      name: "test-attestor",
    }
  );
new google.binaryAuthorizationPolicy.BinaryAuthorizationPolicy(this, "policy", {
  default_admission_rule: [
    {
      enforcement_mode: "ENFORCED_BLOCK_AND_AUDIT_LOG",
      evaluation_mode: "REQUIRE_ATTESTATION",
      require_attestations_by: [googleBinaryAuthorizationAttestorAttestor.name],
    },
  ],
  global_policy_evaluation_mode: "ENABLE",
});

Argument Reference

The following arguments are supported:

defaultAdmissionRule - (Required) Default admission rule for a cluster without a per-cluster admission rule. Structure is documented below.

The defaultAdmissionRule block supports:

evaluationMode - (Required) How this admission rule will be evaluated. Possible values are alwaysAllow, requireAttestation, and alwaysDeny.
requireAttestationsBy - (Optional) The resource names of the attestors that must attest to a container image. If the attestor is in a different project from the policy, it should be specified in the format projects/*/attestors/*. Each attestor must exist before a policy can reference it. To add an attestor to a policy the principal issuing the policy change request must be able to read the attestor resource. Note: this field must be non-empty when the evaluation_mode field specifies REQUIRE_ATTESTATION, otherwise it must be empty.
enforcementMode - (Required) The action when a pod creation is denied by the admission rule. Possible values are enforcedBlockAndAuditLog and dryrunAuditLogOnly.

description - (Optional) A descriptive comment.
globalPolicyEvaluationMode - (Optional) Controls the evaluation of a Google-maintained global admission policy for common system-level images. Images not covered by the global policy will be subject to the project admission policy. Possible values are enable and disable.
admissionWhitelistPatterns - (Optional) A whitelist of image patterns to exclude from admission rules. If an image's name matches a whitelist pattern, the image's admission requests will always be permitted regardless of your admission rules. Structure is documented below.
clusterAdmissionRules - (Optional) Per-cluster admission rules. An admission rule specifies either that all container images used in a pod creation request must be attested to by one or more attestors, that all pod creations will be allowed, or that all pod creations will be denied. There can be at most one admission rule per cluster spec.

Identifier format: {{location}}.{{clusterId}}. A location is either a compute zone (e.g. usCentral1A) or a region (e.g. usCentral1). Structure is documented below.
project - (Optional) The ID of the project in which the resource belongs. If it is not provided, the provider project is used.

The admissionWhitelistPatterns block supports:

namePattern - (Required) An image name pattern to whitelist, in the form registry/path/to/image. This supports a trailing * as a wildcard, but this is allowed only in text after the registry/ part.

The clusterAdmissionRules block supports:

cluster - (Required) The identifier for this object. Format specified above.
evaluationMode - (Required) How this admission rule will be evaluated. Possible values are alwaysAllow, requireAttestation, and alwaysDeny.
requireAttestationsBy - (Optional) The resource names of the attestors that must attest to a container image. If the attestor is in a different project from the policy, it should be specified in the format projects/*/attestors/*. Each attestor must exist before a policy can reference it. To add an attestor to a policy the principal issuing the policy change request must be able to read the attestor resource. Note: this field must be non-empty when the evaluation_mode field specifies REQUIRE_ATTESTATION, otherwise it must be empty.
enforcementMode - (Required) The action when a pod creation is denied by the admission rule. Possible values are enforcedBlockAndAuditLog and dryrunAuditLogOnly.

Attributes Reference

In addition to the arguments listed above, the following computed attributes are exported:

id - an identifier for the resource with format projects/{{project}}

Timeouts

This resource provides the following Timeouts configuration options:

create - Default is 20 minutes.
update - Default is 20 minutes.
delete - Default is 20 minutes.

Import

Policy can be imported using any of these accepted formats:

$ terraform import google_binary_authorization_policy.default projects/{{project}}
$ terraform import google_binary_authorization_policy.default {{project}}

User Project Overrides

This resource supports User Project Overrides.