Check class

A single check to perform against a Pod. Checks are grouped into CheckSet objects, which are defined by the top-level policy.

Constructors

Check({Input<bool>? alwaysDeny, Input<String>? displayName, Input<ImageAllowlist>? imageAllowlist, Input<ImageFreshnessCheck>? imageFreshnessCheck, Input<SimpleSigningAttestationCheck>? simpleSigningAttestationCheck, Input<SlsaCheck>? slsaCheck, Input<TrustedDirectoryCheck>? trustedDirectoryCheck, Input<VulnerabilityCheck>? vulnerabilityCheck})
Creates a new Check. alwaysDeny Optional. A special-case check that always denies. Note that this still only applies when the scope of the CheckSet applies and the image isn't exempted by an image allowlist. This check is primarily useful for testing, or to set the default behavior for all unmatched scopes to "deny". displayName Optional. A user-provided name for this check. This field has no effect on the policy evaluation behavior except to improve readability of messages in evaluation results. imageAllowlist Optional. Images exempted from this check. If any of the patterns match the image url, the check will not be evaluated. imageFreshnessCheck Optional. Require that an image is no older than a configured expiration time. Image age is determined by its upload time. simpleSigningAttestationCheck Optional. Require a SimpleSigning-type attestation for every image in the deployment. slsaCheck Optional. Require that an image was built by a trusted builder (such as Google Cloud Build), meets requirements for Supply chain Levels for Software Artifacts (SLSA), and was built from a trusted source code repostitory. trustedDirectoryCheck Optional. Require that an image lives in a trusted directory. vulnerabilityCheck Optional. Require that an image does not contain vulnerabilities that violate the configured rules, such as based on severity levels.
const
Check.fromMap(Map<String, dynamic> map)
factory

Properties

alwaysDeny → Input<bool>?
Optional. A special-case check that always denies. Note that this still only applies when the scope of the CheckSet applies and the image isn't exempted by an image allowlist. This check is primarily useful for testing, or to set the default behavior for all unmatched scopes to "deny".
final
displayName → Input<String>?
Optional. A user-provided name for this check. This field has no effect on the policy evaluation behavior except to improve readability of messages in evaluation results.
final
hashCode → int
The hash code for this object.
no setterinherited
imageAllowlist → Input<ImageAllowlist>?
Optional. Images exempted from this check. If any of the patterns match the image url, the check will not be evaluated.
final
imageFreshnessCheck → Input<ImageFreshnessCheck>?
Optional. Require that an image is no older than a configured expiration time. Image age is determined by its upload time.
final
runtimeType → Type
A representation of the runtime type of the object.
no setterinherited
simpleSigningAttestationCheck → Input<SimpleSigningAttestationCheck>?
Optional. Require a SimpleSigning-type attestation for every image in the deployment.
final
slsaCheck → Input<SlsaCheck>?
Optional. Require that an image was built by a trusted builder (such as Google Cloud Build), meets requirements for Supply chain Levels for Software Artifacts (SLSA), and was built from a trusted source code repostitory.
final
trustedDirectoryCheck → Input<TrustedDirectoryCheck>?
Optional. Require that an image lives in a trusted directory.
final
vulnerabilityCheck → Input<VulnerabilityCheck>?
Optional. Require that an image does not contain vulnerabilities that violate the configured rules, such as based on severity levels.
final

Methods

noSuchMethod(Invocation invocation) → dynamic
Invoked when a nonexistent method or property is accessed.
inherited
toMap() → Map<String, dynamic>
toString() → String
A string representation of this object.
inherited

Operators

operator ==(Object other) → bool
The equality operator.
inherited