Foo foo = ...;
Any any;
any.PackFrom(foo);
...
if (any.UnpackTo(&foo)) {
...
}
×
PolicyService
CancelDryRunJob
DeletePolicy
DryRunPolicy
POST /v1/policies/dryrun
DryRunPolicy evaluates the given policy and returns any alerts without creating the policy.
EnableDisablePolicyNotification
PATCH /v1/policies/{policyId}/notifiers
EnableDisablePolicyNotification enables or disables notifications for a policy by ID.
ExportPolicies
POST /v1/policies/export
ExportPolicies takes a list of policy IDs and returns either the entire list of policies or an error message
GetPolicy
GetPolicyCategories
GetPolicyMitreVectors
ImportPolicies
POST /v1/policies/import
ImportPolicies accepts a list of Policies and returns a list of the policies which could not be imported
ListPolicies
PatchPolicy
PolicyFromSearch
PostPolicy
PutPolicy
QueryDryRunJobStatus
ReassessPolicies
SubmitDryRunPolicyJob
Common object reference
PolicyMitreAttackVectors
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
tactic |
String |
||||
techniques |
List of |
ProtobufAny
Any contains an arbitrary serialized protocol buffer message along with a
URL that describes the type of the serialized message.
Protobuf library provides support to pack/unpack Any values in the form of utility functions or additional generated methods of the Any type.
Example 1: Pack and unpack a message in C++.
Example 2: Pack and unpack a message in Java.
Foo foo = ...;
Any any = Any.pack(foo);
...
if (any.is(Foo.class)) {
foo = any.unpack(Foo.class);
}
// or ...
if (any.isSameTypeAs(Foo.getDefaultInstance())) {
foo = any.unpack(Foo.getDefaultInstance());
}
Example 3: Pack and unpack a message in Python.
foo = Foo(...) any = Any() any.Pack(foo) ... if any.Is(Foo.DESCRIPTOR): any.Unpack(foo) ...
Example 4: Pack and unpack a message in Go
foo := &pb.Foo{...}
any, err := anypb.New(foo)
if err != nil {
...
}
...
foo := &pb.Foo{}
if err := any.UnmarshalTo(foo); err != nil {
...
}
The pack methods provided by protobuf library will by default use 'type.googleapis.com/full.type.name' as the type URL and the unpack methods only use the fully qualified type name after the last '/' in the type URL, for example "foo.bar.com/x/y.z" will yield type name "y.z".
JSON representation
The JSON representation of an Any value uses the regular
representation of the deserialized, embedded message, with an
additional field @type which contains the type URL. Example:
package google.profile;
message Person {
string first_name = 1;
string last_name = 2;
}
{
"@type": "type.googleapis.com/google.profile.Person",
"firstName": <string>,
"lastName": <string>
}
If the embedded message type is well-known and has a custom JSON
representation, that representation will be embedded adding a field
value which holds the custom JSON in addition to the @type
field. Example (for message [google.protobuf.Duration][]):
{
"@type": "type.googleapis.com/google.protobuf.Duration",
"value": "1.212s"
}
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
typeUrl |
String |
A URL/resource name that uniquely identifies the type of the serialized protocol buffer message. This string must contain at least one \"/\" character. The last segment of the URL’s path must represent the fully qualified name of the type (as in |
|||
value |
byte[] |
Must be a valid serialized protocol buffer of the above specified type. |
byte |
RuntimeError
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
error |
String |
||||
code |
Integer |
int32 |
|||
message |
String |
||||
details |
List of ProtobufAny |
StorageEnforcementAction
-
FAIL_KUBE_REQUEST_ENFORCEMENT: FAIL_KUBE_REQUEST_ENFORCEMENT takes effect only if admission control webhook is enabled to listen on exec and port-forward events.
-
FAIL_DEPLOYMENT_CREATE_ENFORCEMENT: FAIL_DEPLOYMENT_CREATE_ENFORCEMENT takes effect only if admission control webhook is configured to enforce on object creates.
-
FAIL_DEPLOYMENT_UPDATE_ENFORCEMENT: FAIL_DEPLOYMENT_UPDATE_ENFORCEMENT takes effect only if admission control webhook is configured to enforce on object updates.
| Enum Values |
|---|
UNSET_ENFORCEMENT |
SCALE_TO_ZERO_ENFORCEMENT |
UNSATISFIABLE_NODE_CONSTRAINT_ENFORCEMENT |
KILL_POD_ENFORCEMENT |
FAIL_BUILD_ENFORCEMENT |
FAIL_KUBE_REQUEST_ENFORCEMENT |
FAIL_DEPLOYMENT_CREATE_ENFORCEMENT |
FAIL_DEPLOYMENT_UPDATE_ENFORCEMENT |
StorageExclusion
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
name |
String |
||||
deployment |
|||||
image |
|||||
expiration |
Date |
date-time |
StorageExportPoliciesResponse
ExportPoliciesResponse is used by the API but it is defined in storage because we expect customers to store them. We do backwards-compatibility checks on objects in the storge folder and those checks should be applied to this object
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
policies |
List of StoragePolicy |
StorageListPolicy
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
id |
String |
||||
name |
String |
||||
description |
String |
||||
severity |
UNSET_SEVERITY, LOW_SEVERITY, MEDIUM_SEVERITY, HIGH_SEVERITY, CRITICAL_SEVERITY, |
||||
disabled |
Boolean |
||||
lifecycleStages |
List of StorageLifecycleStage |
||||
notifiers |
List of |
||||
lastUpdated |
Date |
date-time |
|||
eventSource |
NOT_APPLICABLE, DEPLOYMENT_EVENT, AUDIT_LOG_EVENT, |
||||
isDefault |
Boolean |
StorageMitreAttackVector
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
tactic |
|||||
techniques |
List of StorageMitreTechnique |
StorageMitreTactic
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
id |
String |
||||
name |
String |
||||
description |
String |
StorageMitreTechnique
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
id |
String |
||||
name |
String |
||||
description |
String |
StoragePolicy
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
id |
String |
||||
name |
String |
||||
description |
String |
||||
rationale |
String |
||||
remediation |
String |
||||
disabled |
Boolean |
||||
categories |
List of |
||||
lifecycleStages |
List of StorageLifecycleStage |
||||
eventSource |
NOT_APPLICABLE, DEPLOYMENT_EVENT, AUDIT_LOG_EVENT, |
||||
exclusions |
List of StorageExclusion |
||||
scope |
List of StorageScope |
||||
severity |
UNSET_SEVERITY, LOW_SEVERITY, MEDIUM_SEVERITY, HIGH_SEVERITY, CRITICAL_SEVERITY, |
||||
enforcementActions |
List of StorageEnforcementAction |
FAIL_DEPLOYMENT_CREATE_ENFORCEMENT takes effect only if admission control webhook is configured to enforce on object creates/updates. FAIL_KUBE_REQUEST_ENFORCEMENT takes effect only if admission control webhook is enabled to listen on exec and port-forward events. FAIL_DEPLOYMENT_UPDATE_ENFORCEMENT takes effect only if admission control webhook is configured to enforce on object updates. |
|||
notifiers |
List of |
||||
lastUpdated |
Date |
date-time |
|||
SORTName |
String |
For internal use only. |
|||
SORTLifecycleStage |
String |
For internal use only. |
|||
SORTEnforcement |
Boolean |
For internal use only. |
|||
policyVersion |
String |
||||
policySections |
List of StoragePolicySection |
||||
mitreAttackVectors |
List of PolicyMitreAttackVectors |
||||
criteriaLocked |
Boolean |
Read-only field. If true, the policy’s criteria fields are rendered read-only. |
|||
mitreVectorsLocked |
Boolean |
Read-only field. If true, the policy’s MITRE ATT&CK fields are rendered read-only. |
|||
isDefault |
Boolean |
Read-only field. Indicates the policy is a default policy if true and a custom policy if false. |
StoragePolicyGroup
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
fieldName |
String |
||||
booleanOperator |
OR, AND, |
||||
negate |
Boolean |
||||
values |
List of StoragePolicyValue |
StoragePolicySection
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
sectionName |
String |
||||
policyGroups |
List of StoragePolicyGroup |
StorageScope
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
cluster |
String |
||||
namespace |
String |
||||
label |
StorageSeverity
| Enum Values |
|---|
UNSET_SEVERITY |
LOW_SEVERITY |
MEDIUM_SEVERITY |
HIGH_SEVERITY |
CRITICAL_SEVERITY |
V1DryRunJobStatusResponse
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
pending |
Boolean |
||||
result |
V1DryRunResponse
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
alerts |
List of V1DryRunResponseAlert |
V1DryRunResponseAlert
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
deployment |
String |
||||
violations |
List of |
V1EnableDisablePolicyNotificationRequest
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
policyId |
String |
||||
notifierIds |
List of |
||||
disable |
Boolean |
V1ExportPoliciesRequest
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
policyIds |
List of |
V1GetPolicyMitreVectorsResponse
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
policy |
|||||
vectors |
List of StorageMitreAttackVector |
V1ImportPoliciesRequest
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
metadata |
|||||
policies |
List of StoragePolicy |
V1ImportPoliciesResponse
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
responses |
List of V1ImportPolicyResponse |
||||
allSucceeded |
Boolean |
V1ImportPolicyError
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
message |
String |
||||
type |
String |
||||
duplicateName |
String |
||||
validationError |
String |
V1ImportPolicyResponse
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
succeeded |
Boolean |
||||
policy |
|||||
errors |
List of V1ImportPolicyError |
V1ListPoliciesResponse
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
policies |
List of StorageListPolicy |
V1PatchPolicyRequest
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
id |
String |
||||
disabled |
Boolean |
V1PolicyCategoriesResponse
| Field Name | Required | Nullable | Type | Description | Format |
|---|---|---|---|---|---|
categories |
List of |