Skip to content

Commit 3dfbdc3

Browse files
Google APIscopybara-github
Google APIs
authored and
copybara-github
committed
feat: add new admission rule types to Policy
feat: update SignatureAlgorithm enum to match algorithm names in KMS feat: add SystemPolicyV1Beta1 service PiperOrigin-RevId: 408346628
1 parent cbba92c commit 3dfbdc3

3 files changed

Lines changed: 159 additions & 126 deletions

File tree

‎google/cloud/binaryauthorization/v1beta1/binaryauthorization_v1beta1.yaml‎

Lines changed: 27 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ title: Binary Authorization API
55

66
apis:
77
- name: google.cloud.binaryauthorization.v1beta1.BinauthzManagementServiceV1Beta1
8+
- name: google.cloud.binaryauthorization.v1beta1.SystemPolicyV1Beta1
89

910
documentation:
1011
summary: |-
@@ -21,25 +22,48 @@ documentation:
2122
Sets the access control policy on the specified resource. Replaces
2223
any existing policy.
2324
24-
Can return Public Errors: NOT_FOUND, INVALID_ARGUMENT and
25-
PERMISSION_DENIED
25+
Can return `NOT_FOUND`, `INVALID_ARGUMENT`, and `PERMISSION_DENIED`
26+
errors.
2627
2728
- selector: google.iam.v1.IAMPolicy.TestIamPermissions
2829
description: |-
2930
Returns permissions that a caller has on the specified resource. If the
3031
resource does not exist, this will return an empty set of
31-
permissions, not a NOT_FOUND error.
32+
permissions, not a `NOT_FOUND` error.
3233
3334
Note: This operation is designed to be used for building
3435
permission-aware UIs and command-line tools, not for authorization
3536
checking. This operation may "fail open" without warning.
3637
38+
http:
39+
rules:
40+
- selector: google.iam.v1.IAMPolicy.GetIamPolicy
41+
get: '/v1beta1/{resource=projects/*/policy}:getIamPolicy'
42+
additional_bindings:
43+
- get: '/v1beta1/{resource=projects/*/attestors/*}:getIamPolicy'
44+
- selector: google.iam.v1.IAMPolicy.SetIamPolicy
45+
post: '/v1beta1/{resource=projects/*/policy}:setIamPolicy'
46+
body: '*'
47+
additional_bindings:
48+
- post: '/v1beta1/{resource=projects/*/attestors/*}:setIamPolicy'
49+
body: '*'
50+
- selector: google.iam.v1.IAMPolicy.TestIamPermissions
51+
post: '/v1beta1/{resource=projects/*/policy}:testIamPermissions'
52+
body: '*'
53+
additional_bindings:
54+
- post: '/v1beta1/{resource=projects/*/attestors/*}:testIamPermissions'
55+
body: '*'
56+
3757
authentication:
3858
rules:
3959
- selector: 'google.cloud.binaryauthorization.v1beta1.BinauthzManagementServiceV1Beta1.*'
4060
oauth:
4161
canonical_scopes: |-
4262
https://www.googleapis.com/auth/cloud-platform
63+
- selector: google.cloud.binaryauthorization.v1beta1.SystemPolicyV1Beta1.GetSystemPolicy
64+
oauth:
65+
canonical_scopes: |-
66+
https://www.googleapis.com/auth/cloud-platform
4367
- selector: 'google.iam.v1.IAMPolicy.*'
4468
oauth:
4569
canonical_scopes: |-

‎google/cloud/binaryauthorization/v1beta1/resources.proto‎

Lines changed: 65 additions & 51 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
// Copyright 2021 Google LLC.
1+
// Copyright 2021 Google LLC
22
//
33
// Licensed under the Apache License, Version 2.0 (the "License");
44
// you may not use this file except in compliance with the License.
@@ -11,16 +11,15 @@
1111
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
1212
// See the License for the specific language governing permissions and
1313
// limitations under the License.
14-
//
1514

1615
syntax = "proto3";
1716

1817
package google.cloud.binaryauthorization.v1beta1;
1918

20-
import "google/api/annotations.proto";
2119
import "google/api/field_behavior.proto";
2220
import "google/api/resource.proto";
2321
import "google/protobuf/timestamp.proto";
22+
import "google/api/annotations.proto";
2423

2524
option cc_enable_arenas = true;
2625
option csharp_namespace = "Google.Cloud.BinaryAuthorization.V1Beta1";
@@ -31,12 +30,12 @@ option java_package = "com.google.cloud.binaryauthorization.v1beta1";
3130
option php_namespace = "Google\\Cloud\\BinaryAuthorization\\V1beta1";
3231
option ruby_package = "Google::Cloud::BinaryAuthorization::V1beta1";
3332

34-
// A [policy][google.cloud.binaryauthorization.v1beta1.Policy] for container
35-
// image binary authorization.
33+
// A [policy][google.cloud.binaryauthorization.v1beta1.Policy] for Binary Authorization.
3634
message Policy {
3735
option (google.api.resource) = {
3836
type: "binaryauthorization.googleapis.com/Policy"
3937
pattern: "projects/{project}/policy"
38+
pattern: "locations/{location}/policy"
4039
};
4140

4241
enum GlobalPolicyEvaluationMode {
@@ -61,14 +60,12 @@ message Policy {
6160
// policy for common system-level images. Images not covered by the global
6261
// policy will be subject to the project admission policy. This setting
6362
// has no effect when specified inside a global admission policy.
64-
GlobalPolicyEvaluationMode global_policy_evaluation_mode = 7
65-
[(google.api.field_behavior) = OPTIONAL];
63+
GlobalPolicyEvaluationMode global_policy_evaluation_mode = 7 [(google.api.field_behavior) = OPTIONAL];
6664

6765
// Optional. Admission policy allowlisting. A matching admission request will
6866
// always be permitted. This feature is typically used to exclude Google or
6967
// third-party infrastructure images from Binary Authorization policies.
70-
repeated AdmissionWhitelistPattern admission_whitelist_patterns = 2
71-
[(google.api.field_behavior) = OPTIONAL];
68+
repeated AdmissionWhitelistPattern admission_whitelist_patterns = 2 [(google.api.field_behavior) = OPTIONAL];
7269

7370
// Optional. Per-cluster admission rules. Cluster spec format:
7471
// `location.clusterId`. There can be at most one admission rule per cluster
@@ -77,38 +74,50 @@ message Policy {
7774
// (e.g. us-central1).
7875
// For `clusterId` syntax restrictions see
7976
// https://cloud.google.com/container-engine/reference/rest/v1/projects.zones.clusters.
80-
map<string, AdmissionRule> cluster_admission_rules = 3
81-
[(google.api.field_behavior) = OPTIONAL];
77+
map<string, AdmissionRule> cluster_admission_rules = 3 [(google.api.field_behavior) = OPTIONAL];
78+
79+
// Optional. Per-kubernetes-namespace admission rules. K8s namespace spec format:
80+
// `[a-z.-]+`, e.g. `some-namespace`
81+
map<string, AdmissionRule> kubernetes_namespace_admission_rules = 10 [(google.api.field_behavior) = OPTIONAL];
82+
83+
// Optional. Per-kubernetes-service-account admission rules. Service account
84+
// spec format: `namespace:serviceaccount`. e.g. `test-ns:default`
85+
map<string, AdmissionRule> kubernetes_service_account_admission_rules = 8 [(google.api.field_behavior) = OPTIONAL];
86+
87+
// Optional. Per-istio-service-identity admission rules. Istio service
88+
// identity spec format:
89+
// `spiffe://<domain>/ns/<namespace>/sa/<serviceaccount>` or
90+
// `<domain>/ns/<namespace>/sa/<serviceaccount>`
91+
// e.g. `spiffe://example.com/ns/test-ns/sa/default`
92+
map<string, AdmissionRule> istio_service_identity_admission_rules = 9 [(google.api.field_behavior) = OPTIONAL];
8293

8394
// Required. Default admission rule for a cluster without a per-cluster, per-
8495
// kubernetes-service-account, or per-istio-service-identity admission rule.
85-
AdmissionRule default_admission_rule = 4
86-
[(google.api.field_behavior) = REQUIRED];
96+
AdmissionRule default_admission_rule = 4 [(google.api.field_behavior) = REQUIRED];
8797

8898
// Output only. Time when the policy was last updated.
89-
google.protobuf.Timestamp update_time = 5
90-
[(google.api.field_behavior) = OUTPUT_ONLY];
99+
google.protobuf.Timestamp update_time = 5 [(google.api.field_behavior) = OUTPUT_ONLY];
91100
}
92101

93-
// An [admission allowlist
94-
// pattern][google.cloud.binaryauthorization.v1beta1.AdmissionWhitelistPattern]
95-
// exempts images from checks by [admission
96-
// rules][google.cloud.binaryauthorization.v1beta1.AdmissionRule].
102+
// An [admission allowlist pattern][google.cloud.binaryauthorization.v1beta1.AdmissionWhitelistPattern] exempts images
103+
// from checks by [admission rules][google.cloud.binaryauthorization.v1beta1.AdmissionRule].
97104
message AdmissionWhitelistPattern {
98-
// An image name pattern to allow, in the form `registry/path/to/image`.
105+
// An image name pattern to allowlist, in the form `registry/path/to/image`.
99106
// This supports a trailing `*` as a wildcard, but this is allowed only in
100-
// text after the `registry/` part.
107+
// text after the `registry/` part. `*` wildcard does not match `/`, i.e.,
108+
// `gcr.io/nginx*` matches `gcr.io/nginx@latest`, but it does not match
109+
// `gcr.io/nginx/image`. This also supports a trailing `**` wildcard which
110+
// matches subdirectories, i.e., `gcr.io/nginx**` matches
111+
// `gcr.io/nginx/image`.
101112
string name_pattern = 1;
102113
}
103114

104-
// An [admission rule][google.cloud.binaryauthorization.v1beta1.AdmissionRule]
105-
// specifies either that all container images used in a pod creation request
106-
// must be attested to by one or more
107-
// [attestors][google.cloud.binaryauthorization.v1beta1.Attestor], that all pod
108-
// creations will be allowed, or that all pod creations will be denied.
115+
// An [admission rule][google.cloud.binaryauthorization.v1beta1.AdmissionRule] specifies either that all container images
116+
// used in a pod creation request must be attested to by one or more
117+
// [attestors][google.cloud.binaryauthorization.v1beta1.Attestor], that all pod creations will be allowed, or that all
118+
// pod creations will be denied.
109119
//
110-
// Images matching an [admission allowlist
111-
// pattern][google.cloud.binaryauthorization.v1beta1.AdmissionWhitelistPattern]
120+
// Images matching an [admission allowlist pattern][google.cloud.binaryauthorization.v1beta1.AdmissionWhitelistPattern]
112121
// are exempted from admission rules and will never block a pod creation.
113122
message AdmissionRule {
114123
enum EvaluationMode {
@@ -119,7 +128,7 @@ message AdmissionRule {
119128
ALWAYS_ALLOW = 1;
120129

121130
// This rule allows a pod creation if all the attestors listed in
122-
// 'require_attestations_by' have valid attestations for all of the
131+
// `require_attestations_by` have valid attestations for all of the
123132
// images in the pod spec.
124133
REQUIRE_ATTESTATION = 2;
125134

@@ -152,16 +161,15 @@ message AdmissionRule {
152161
//
153162
// Note: this field must be non-empty when the evaluation_mode field specifies
154163
// REQUIRE_ATTESTATION, otherwise it must be empty.
155-
repeated string require_attestations_by = 2
156-
[(google.api.field_behavior) = OPTIONAL];
164+
repeated string require_attestations_by = 2 [(google.api.field_behavior) = OPTIONAL];
157165

158166
// Required. The action when a pod creation is denied by the admission rule.
159167
EnforcementMode enforcement_mode = 3 [(google.api.field_behavior) = REQUIRED];
160168
}
161169

162-
// An [attestor][google.cloud.binaryauthorization.v1beta1.Attestor] that attests
163-
// to container image artifacts. An existing attestor cannot be modified except
164-
// where indicated.
170+
// An [attestor][google.cloud.binaryauthorization.v1beta1.Attestor] that attests to container image
171+
// artifacts. An existing attestor cannot be modified except where
172+
// indicated.
165173
message Attestor {
166174
option (google.api.resource) = {
167175
type: "binaryauthorization.googleapis.com/Attestor"
@@ -176,24 +184,22 @@ message Attestor {
176184
// The field may be displayed in chooser dialogs.
177185
string description = 6 [(google.api.field_behavior) = OPTIONAL];
178186

179-
// Required. Identifies an
180-
// [attestor][google.cloud.binaryauthorization.v1beta1.Attestor] that attests
181-
// to a container image artifact. This determines how an attestation will be
182-
// stored, and how it will be used during policy enforcement. Updates may not
183-
// change the attestor type, but individual attestor fields may be updated
187+
// Required. Identifies an [attestor][google.cloud.binaryauthorization.v1beta1.Attestor] that attests to a
188+
// container image artifact. This determines how an attestation will
189+
// be stored, and how it will be used during policy
190+
// enforcement. Updates may not change the attestor type, but individual
191+
// attestor fields may be updated.
184192
oneof attestor_type {
185193
// A Drydock ATTESTATION_AUTHORITY Note, created by the user.
186194
UserOwnedDrydockNote user_owned_drydock_note = 3;
187195
}
188196

189197
// Output only. Time when the attestor was last updated.
190-
google.protobuf.Timestamp update_time = 4
191-
[(google.api.field_behavior) = OUTPUT_ONLY];
198+
google.protobuf.Timestamp update_time = 4 [(google.api.field_behavior) = OUTPUT_ONLY];
192199
}
193200

194-
// An [user owned drydock
195-
// note][google.cloud.binaryauthorization.v1beta1.UserOwnedDrydockNote]
196-
// references a Drydock ATTESTATION_AUTHORITY Note created by the user.
201+
// An [user owned drydock note][google.cloud.binaryauthorization.v1beta1.UserOwnedDrydockNote] references a Drydock
202+
// ATTESTATION_AUTHORITY Note created by the user.
197203
message UserOwnedDrydockNote {
198204
// Required. The Drydock resource name of a ATTESTATION_AUTHORITY Note,
199205
// created by the user, in the format: `projects/*/notes/*` (or the legacy
@@ -213,8 +219,7 @@ message UserOwnedDrydockNote {
213219
//
214220
// If this field is empty, this attestor always returns that no
215221
// valid attestations exist.
216-
repeated AttestorPublicKey public_keys = 2
217-
[(google.api.field_behavior) = OPTIONAL];
222+
repeated AttestorPublicKey public_keys = 2 [(google.api.field_behavior) = OPTIONAL];
218223

219224
// Output only. This field will contain the service account email address
220225
// that this Attestor will use as the principal when querying Container
@@ -225,8 +230,7 @@ message UserOwnedDrydockNote {
225230
// This email address is fixed for the lifetime of the Attestor, but callers
226231
// should not make any other assumptions about the service account email;
227232
// future versions may use an email based on a different naming pattern.
228-
string delegation_service_account_email = 3
229-
[(google.api.field_behavior) = OUTPUT_ONLY];
233+
string delegation_service_account_email = 3 [(google.api.field_behavior) = OUTPUT_ONLY];
230234
}
231235

232236
// A public key in the PkixPublicKey format (see
@@ -241,6 +245,8 @@ message PkixPublicKey {
241245
// See https://cloud.google.com/kms/docs/algorithms. In the future, BinAuthz
242246
// might support additional public key types independently of Tink and/or KMS.
243247
enum SignatureAlgorithm {
248+
option allow_alias = true;
249+
244250
// Not specified.
245251
SIGNATURE_ALGORITHM_UNSPECIFIED = 0;
246252

@@ -271,11 +277,20 @@ message PkixPublicKey {
271277
// ECDSA on the NIST P-256 curve with a SHA256 digest.
272278
ECDSA_P256_SHA256 = 9;
273279

280+
// ECDSA on the NIST P-256 curve with a SHA256 digest.
281+
EC_SIGN_P256_SHA256 = 9;
282+
274283
// ECDSA on the NIST P-384 curve with a SHA384 digest.
275284
ECDSA_P384_SHA384 = 10;
276285

286+
// ECDSA on the NIST P-384 curve with a SHA384 digest.
287+
EC_SIGN_P384_SHA384 = 10;
288+
277289
// ECDSA on the NIST P-521 curve with a SHA512 digest.
278290
ECDSA_P521_SHA512 = 11;
291+
292+
// ECDSA on the NIST P-521 curve with a SHA512 digest.
293+
EC_SIGN_P521_SHA512 = 11;
279294
}
280295

281296
// A PEM-encoded public key, as described in
@@ -290,9 +305,8 @@ message PkixPublicKey {
290305
SignatureAlgorithm signature_algorithm = 2;
291306
}
292307

293-
// An [attestor public
294-
// key][google.cloud.binaryauthorization.v1beta1.AttestorPublicKey] that will be
295-
// used to verify attestations signed by this attestor.
308+
// An [attestor public key][google.cloud.binaryauthorization.v1beta1.AttestorPublicKey] that will be used to verify
309+
// attestations signed by this attestor.
296310
message AttestorPublicKey {
297311
// Optional. A descriptive comment. This field may be updated.
298312
string comment = 1 [(google.api.field_behavior) = OPTIONAL];

0 commit comments

Comments
 (0)