binaryauthorization library

Classes

AttestationAuthenticator
An attestation authenticator that will be used to verify attestations. Typically this is just a set of public keys. Conceptually, an authenticator can be treated as always returning either "authenticated" or "not authenticated" when presented with a signed attestation (almost always assumed to be a DSSE attestation). The details of how an authenticator makes this decision are specific to the type of 'authenticator' that this message wraps.
AttestationAuthenticatorResponse
An attestation authenticator that will be used to verify attestations. Typically this is just a set of public keys. Conceptually, an authenticator can be treated as always returning either "authenticated" or "not authenticated" when presented with a signed attestation (almost always assumed to be a DSSE attestation). The details of how an authenticator makes this decision are specific to the type of 'authenticator' that this message wraps.
AttestationSource
Specifies the locations for fetching the provenance attestations.
AttestationSourceResponse
Specifies the locations for fetching the provenance attestations.
Attestor
Creates an attestor, and returns a copy of the new attestor. Returns NOT_FOUND if the project does not exist, INVALID_ARGUMENT if the request is malformed, ALREADY_EXISTS if the attestor already exists.
AttestorArgs
The set of arguments for Attestor. The set of arguments for Attestor.
AttestorBinaryauthorizationV1beta1
Creates an attestor, and returns a copy of the new attestor. Returns NOT_FOUND if the project does not exist, INVALID_ARGUMENT if the request is malformed, ALREADY_EXISTS if the attestor already exists.
AttestorBinaryauthorizationV1beta1Args
The set of arguments for Attestor. The set of arguments for Attestor.
AttestorIamBinding
Sets the access control policy on the specified resource. Replaces any existing policy. Can return NOT_FOUND, INVALID_ARGUMENT, and PERMISSION_DENIED errors.
AttestorIamBindingArgs
The set of arguments for AttestorIamBinding. The set of arguments for AttestorIamBinding.
AttestorIamBindingBinaryauthorizationV1beta1
Sets the access control policy on the specified resource. Replaces any existing policy. Can return NOT_FOUND, INVALID_ARGUMENT, and PERMISSION_DENIED errors.
AttestorIamBindingBinaryauthorizationV1beta1Args
The set of arguments for AttestorIamBinding. The set of arguments for AttestorIamBinding.
AttestorIamMember
Sets the access control policy on the specified resource. Replaces any existing policy. Can return NOT_FOUND, INVALID_ARGUMENT, and PERMISSION_DENIED errors.
AttestorIamMemberArgs
The set of arguments for AttestorIamMember. The set of arguments for AttestorIamMember.
AttestorIamMemberBinaryauthorizationV1beta1
Sets the access control policy on the specified resource. Replaces any existing policy. Can return NOT_FOUND, INVALID_ARGUMENT, and PERMISSION_DENIED errors.
AttestorIamMemberBinaryauthorizationV1beta1Args
The set of arguments for AttestorIamMember. The set of arguments for AttestorIamMember.
AttestorIamPolicy
Sets the access control policy on the specified resource. Replaces any existing policy. Can return NOT_FOUND, INVALID_ARGUMENT, and PERMISSION_DENIED errors. Note - this resource's API doesn't support deletion. When deleted, the resource will persist on Google Cloud even though it will be deleted from Pulumi state.
AttestorIamPolicyArgs
The set of arguments for AttestorIamPolicy. The set of arguments for AttestorIamPolicy.
AttestorIamPolicyBinaryauthorizationV1beta1
Sets the access control policy on the specified resource. Replaces any existing policy. Can return NOT_FOUND, INVALID_ARGUMENT, and PERMISSION_DENIED errors. Note - this resource's API doesn't support deletion. When deleted, the resource will persist on Google Cloud even though it will be deleted from Pulumi state.
AttestorIamPolicyBinaryauthorizationV1beta1Args
The set of arguments for AttestorIamPolicy. The set of arguments for AttestorIamPolicy.
AttestorPublicKey
An attestor public key that will be used to verify attestations signed by this attestor.
AttestorPublicKeyBinaryauthorizationV1beta1
An attestor public key that will be used to verify attestations signed by this attestor.
AttestorPublicKeyResponse
An attestor public key that will be used to verify attestations signed by this attestor.
AttestorPublicKeyResponseBinaryauthorizationV1beta1
An attestor public key that will be used to verify attestations signed by this attestor.
Binding
Associates members, or principals, with a role.
BindingBinaryauthorizationV1beta1
Associates members, or principals, with a role.
BindingResponse
Associates members, or principals, with a role.
BindingResponseBinaryauthorizationV1beta1
Associates members, or principals, with a role.
Check
A single check to perform against a Pod. Checks are grouped into CheckSet objects, which are defined by the top-level policy.
CheckResponse
A single check to perform against a Pod. Checks are grouped into CheckSet objects, which are defined by the top-level policy.
CheckSet
A conjunction of policy checks, scoped to a particular namespace or Kubernetes service account. In order for evaluation of a CheckSet to return "allowed" for a given image in a given Pod, one of the following conditions must be satisfied: * The image is explicitly exempted by an entry in image_allowlist, OR * ALL of the checks evaluate to "allowed".
CheckSetResponse
A conjunction of policy checks, scoped to a particular namespace or Kubernetes service account. In order for evaluation of a CheckSet to return "allowed" for a given image in a given Pod, one of the following conditions must be satisfied: * The image is explicitly exempted by an entry in image_allowlist, OR * ALL of the checks evaluate to "allowed".
Expr
Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
ExprBinaryauthorizationV1beta1
Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
ExprResponse
Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
ExprResponseBinaryauthorizationV1beta1
Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
GetAttestorArgs
Arguments for getAttestor. Arguments for getAttestor.
GetAttestorBinaryauthorizationV1beta1Args
Arguments for getAttestor. Arguments for getAttestor.
GetAttestorBinaryauthorizationV1beta1Result
Result data returned by getAttestor.
GetAttestorIamPolicyArgs
Arguments for getAttestorIamPolicy. Arguments for getAttestorIamPolicy.
GetAttestorIamPolicyBinaryauthorizationV1beta1Args
Arguments for getAttestorIamPolicy. Arguments for getAttestorIamPolicy.
GetAttestorIamPolicyBinaryauthorizationV1beta1Result
Result data returned by getAttestorIamPolicy.
GetAttestorIamPolicyResult
Result data returned by getAttestorIamPolicy.
GetAttestorResult
Result data returned by getAttestor.
GetPolicyArgs
Arguments for getPolicy. Arguments for getPolicy.
GetPolicyIamPolicyArgs
Arguments for getPolicyIamPolicy. Arguments for getPolicyIamPolicy.
GetPolicyIamPolicyBinaryauthorizationV1beta1Args
Arguments for getPolicyIamPolicy. Arguments for getPolicyIamPolicy.
GetPolicyIamPolicyBinaryauthorizationV1beta1Result
Result data returned by getPolicyIamPolicy.
GetPolicyIamPolicyResult
Result data returned by getPolicyIamPolicy.
GetPolicyResult
Result data returned by getPolicy.
GkePolicy
A Binary Authorization policy for a GKE cluster. This is one type of policy that can occur as a PlatformPolicy.
GkePolicyResponse
A Binary Authorization policy for a GKE cluster. This is one type of policy that can occur as a PlatformPolicy.
ImageAllowlist
Images that are exempted from normal checks based on name pattern only.
ImageAllowlistResponse
Images that are exempted from normal checks based on name pattern only.
ImageFreshnessCheck
An image freshness check, which rejects images that were uploaded before the set number of days ago to the supported repositories.
ImageFreshnessCheckResponse
An image freshness check, which rejects images that were uploaded before the set number of days ago to the supported repositories.
PkixPublicKey
A public key in the PkixPublicKey format. Public keys of this type are typically textually encoded using the PEM format.
PkixPublicKeyBinaryauthorizationV1beta1
A public key in the PkixPublicKey format (see https://tools.ietf.org/html/rfc5280#section-4.1.2.7 for details). Public keys of this type are typically textually encoded using the PEM format.
PkixPublicKeyResponse
A public key in the PkixPublicKey format. Public keys of this type are typically textually encoded using the PEM format.
PkixPublicKeyResponseBinaryauthorizationV1beta1
A public key in the PkixPublicKey format (see https://tools.ietf.org/html/rfc5280#section-4.1.2.7 for details). Public keys of this type are typically textually encoded using the PEM format.
PkixPublicKeySet
A bundle of PKIX public keys, used to authenticate attestation signatures. Generally, a signature is considered to be authenticated by a PkixPublicKeySet if any of the public keys verify it (i.e. it is an "OR" of the keys).
PkixPublicKeySetResponse
A bundle of PKIX public keys, used to authenticate attestation signatures. Generally, a signature is considered to be authenticated by a PkixPublicKeySet if any of the public keys verify it (i.e. it is an "OR" of the keys).
Policy
Creates a platform policy, and returns a copy of it. Returns NOT_FOUND if the project or platform doesn't exist, INVALID_ARGUMENT if the request is malformed, ALREADY_EXISTS if the policy already exists, and INVALID_ARGUMENT if the policy contains a platform-specific policy that does not match the platform value specified in the URL. Auto-naming is currently not supported for this resource.
PolicyArgs
The set of arguments for Policy. The set of arguments for Policy.
PolicyIamBinding
Sets the access control policy on the specified resource. Replaces any existing policy. Can return NOT_FOUND, INVALID_ARGUMENT, and PERMISSION_DENIED errors.
PolicyIamBindingArgs
The set of arguments for PolicyIamBinding. The set of arguments for PolicyIamBinding.
PolicyIamBindingBinaryauthorizationV1beta1
Sets the access control policy on the specified resource. Replaces any existing policy. Can return NOT_FOUND, INVALID_ARGUMENT, and PERMISSION_DENIED errors.
PolicyIamBindingBinaryauthorizationV1beta1Args
The set of arguments for PolicyIamBinding. The set of arguments for PolicyIamBinding.
PolicyIamMember
Sets the access control policy on the specified resource. Replaces any existing policy. Can return NOT_FOUND, INVALID_ARGUMENT, and PERMISSION_DENIED errors.
PolicyIamMemberArgs
The set of arguments for PolicyIamMember. The set of arguments for PolicyIamMember.
PolicyIamMemberBinaryauthorizationV1beta1
Sets the access control policy on the specified resource. Replaces any existing policy. Can return NOT_FOUND, INVALID_ARGUMENT, and PERMISSION_DENIED errors.
PolicyIamMemberBinaryauthorizationV1beta1Args
The set of arguments for PolicyIamMember. The set of arguments for PolicyIamMember.
PolicyIamPolicy
Sets the access control policy on the specified resource. Replaces any existing policy. Can return NOT_FOUND, INVALID_ARGUMENT, and PERMISSION_DENIED errors. Note - this resource's API doesn't support deletion. When deleted, the resource will persist on Google Cloud even though it will be deleted from Pulumi state.
PolicyIamPolicyArgs
The set of arguments for PolicyIamPolicy. The set of arguments for PolicyIamPolicy.
PolicyIamPolicyBinaryauthorizationV1beta1
Sets the access control policy on the specified resource. Replaces any existing policy. Can return NOT_FOUND, INVALID_ARGUMENT, and PERMISSION_DENIED errors. Note - this resource's API doesn't support deletion. When deleted, the resource will persist on Google Cloud even though it will be deleted from Pulumi state.
PolicyIamPolicyBinaryauthorizationV1beta1Args
The set of arguments for PolicyIamPolicy. The set of arguments for PolicyIamPolicy.
Scope
A scope specifier for CheckSet objects.
ScopeResponse
A scope specifier for CheckSet objects.
SimpleSigningAttestationCheck
Require a signed DSSE attestation with type SimpleSigning.
SimpleSigningAttestationCheckResponse
Require a signed DSSE attestation with type SimpleSigning.
SlsaCheck
A SLSA provenance attestation check, which ensures that images are built by a trusted builder using source code from its trusted repositories only.
SlsaCheckResponse
A SLSA provenance attestation check, which ensures that images are built by a trusted builder using source code from its trusted repositories only.
TrustedDirectoryCheck
A trusted directory check, which rejects images that do not come from the set of user-configured trusted directories.
TrustedDirectoryCheckResponse
A trusted directory check, which rejects images that do not come from the set of user-configured trusted directories.
UserOwnedDrydockNote
An user owned drydock note references a Drydock ATTESTATION_AUTHORITY Note created by the user.
UserOwnedDrydockNoteResponse
An user owned drydock note references a Drydock ATTESTATION_AUTHORITY Note created by the user.
UserOwnedGrafeasNote
An user owned Grafeas note references a Grafeas Attestation.Authority Note created by the user.
UserOwnedGrafeasNoteResponse
An user owned Grafeas note references a Grafeas Attestation.Authority Note created by the user.
VerificationRule
Specifies verification rules for evaluating the SLSA attestations including: which builders to trust, where to fetch the SLSA attestations generated by those builders, and other builder-specific evaluation rules such as which source repositories are trusted. An image is considered verified by the rule if any of the fetched SLSA attestations is verified.
VerificationRuleResponse
Specifies verification rules for evaluating the SLSA attestations including: which builders to trust, where to fetch the SLSA attestations generated by those builders, and other builder-specific evaluation rules such as which source repositories are trusted. An image is considered verified by the rule if any of the fetched SLSA attestations is verified.
VulnerabilityCheck
An image vulnerability check, which rejects images that violate the configured vulnerability rules.
VulnerabilityCheckResponse
An image vulnerability check, which rejects images that violate the configured vulnerability rules.

Enums

PkixPublicKeySignatureAlgorithm
The signature algorithm used to verify a message against a signature using this key. These signature algorithm must match the structure and any object identifiers encoded in public_key_pem (i.e. this algorithm must match that of the public key).
PkixPublicKeySignatureAlgorithmBinaryauthorizationV1beta1
The signature algorithm used to verify a message against a signature using this key. These signature algorithm must match the structure and any object identifiers encoded in public_key_pem (i.e. this algorithm must match that of the public key).
VerificationRuleTrustedBuilder
Each verification rule is used for evaluation against provenances generated by a specific builder (group). For some of the builders, such as the Google Cloud Build, users don't need to explicitly specify their roots of trust in the policy since the evaluation service can automatically fetch them based on the builder (group).
VulnerabilityCheckMaximumFixableSeverity
Required. The threshold for severity for which a fix is currently available. This field is required and must be set.
VulnerabilityCheckMaximumUnfixableSeverity
Required. The threshold for severity for which a fix isn't currently available. This field is required and must be set.

Functions

getAttestor(GetAttestorArgs args, {InvokeOptions? options}) → Future<GetAttestorResult>
Gets an attestor. Returns NOT_FOUND if the attestor does not exist. args Arguments passed to this invoke. Arguments for getAttestor. options Invoke options controlling this call.
getAttestorBinaryauthorizationV1beta1(GetAttestorBinaryauthorizationV1beta1Args args, {InvokeOptions? options}) → Future<GetAttestorBinaryauthorizationV1beta1Result>
Gets an attestor. Returns NOT_FOUND if the attestor does not exist. args Arguments passed to this invoke. Arguments for getAttestor. options Invoke options controlling this call.
getAttestorIamPolicy(GetAttestorIamPolicyArgs args, {InvokeOptions? options}) → Future<GetAttestorIamPolicyResult>
Gets the access control policy for a resource. Returns an empty policy if the resource exists and does not have a policy set. args Arguments passed to this invoke. Arguments for getAttestorIamPolicy. options Invoke options controlling this call.
getAttestorIamPolicyBinaryauthorizationV1beta1(GetAttestorIamPolicyBinaryauthorizationV1beta1Args args, {InvokeOptions? options}) → Future<GetAttestorIamPolicyBinaryauthorizationV1beta1Result>
Gets the access control policy for a resource. Returns an empty policy if the resource exists and does not have a policy set. args Arguments passed to this invoke. Arguments for getAttestorIamPolicy. options Invoke options controlling this call.
getPolicy(GetPolicyArgs args, {InvokeOptions? options}) → Future<GetPolicyResult>
Gets a platform policy. Returns NOT_FOUND if the policy doesn't exist. args Arguments passed to this invoke. Arguments for getPolicy. options Invoke options controlling this call.
getPolicyIamPolicy(GetPolicyIamPolicyArgs args, {InvokeOptions? options}) → Future<GetPolicyIamPolicyResult>
Gets the access control policy for a resource. Returns an empty policy if the resource exists and does not have a policy set. args Arguments passed to this invoke. Arguments for getPolicyIamPolicy. options Invoke options controlling this call.
getPolicyIamPolicyBinaryauthorizationV1beta1(GetPolicyIamPolicyBinaryauthorizationV1beta1Args args, {InvokeOptions? options}) → Future<GetPolicyIamPolicyBinaryauthorizationV1beta1Result>
Gets the access control policy for a resource. Returns an empty policy if the resource exists and does not have a policy set. args Arguments passed to this invoke. Arguments for getPolicyIamPolicy. options Invoke options controlling this call.