Close httplib2 connections.
evaluate(name, body=None, x__xgafv=None)
Evaluates a Kubernetes object versus a GKE platform policy. Returns `NOT_FOUND` if the policy doesn't exist, `INVALID_ARGUMENT` if the policy or request is malformed and `PERMISSION_DENIED` if the client does not have sufficient permissions.
close()
Close httplib2 connections.
evaluate(name, body=None, x__xgafv=None)
Evaluates a Kubernetes object versus a GKE platform policy. Returns `NOT_FOUND` if the policy doesn't exist, `INVALID_ARGUMENT` if the policy or request is malformed and `PERMISSION_DENIED` if the client does not have sufficient permissions.
Args:
name: string, Required. The name of the platform policy to evaluate in the format `projects/*/platforms/*/policies/*`. (required)
body: object, The request body.
The object takes the form of:
{ # Request message for PlatformPolicyEvaluationService.EvaluateGkePolicy.
"resource": { # Required. JSON or YAML blob representing a Kubernetes resource.
"a_key": "", # Properties of the object.
},
}
x__xgafv: string, V1 error format.
Allowed values
1 - v1 error format
2 - v2 error format
Returns:
An object of the form:
{ # Response message for PlatformPolicyEvaluationService.EvaluateGkePolicy.
"results": [ # Evaluation result for each Pod contained in the request.
{ # Result of evaluating the whole GKE policy for one Pod.
"imageResults": [ # Per-image details.
{ # Result of evaluating one image.
"allowlistResult": { # Result of evaluating an image name allowlist. # If the image was exempted by a top-level allow_pattern, contains the allowlist pattern that the image name matched.
"matchedPattern": "A String", # The allowlist pattern that the image matched.
},
"checkSetResult": { # Result of evaluating one check set. # If a check set was evaluated, contains the result of the check set. Empty if there were no check sets.
"allowlistResult": { # Result of evaluating an image name allowlist. # If the image was exempted by an allow_pattern in the check set, contains the pattern that the image name matched.
"matchedPattern": "A String", # The allowlist pattern that the image matched.
},
"checkResults": { # Result of evaluating one or more checks. # If checks were evaluated, contains the results of evaluating each check.
"results": [ # Per-check details.
{ # Result of evaluating one check.
"allowlistResult": { # Result of evaluating an image name allowlist. # If the image was exempted by an allow_pattern in the check, contains the pattern that the image name matched.
"matchedPattern": "A String", # The allowlist pattern that the image matched.
},
"displayName": "A String", # The name of the check.
"evaluationResult": { # Result of evaluating one check. # If a check was evaluated, contains the result of the check.
"verdict": "A String", # The result of evaluating this check.
},
"explanation": "A String", # Explanation of this check result.
"index": "A String", # The index of the check.
"type": "A String", # The type of the check.
},
],
},
"displayName": "A String", # The name of the check set.
"explanation": "A String", # Explanation of this check set result. Only populated if no checks were evaluated.
"index": "A String", # The index of the check set.
"scope": { # A scope specifier for `CheckSet` objects. # The scope of the check set.
"kubernetesNamespace": "A String", # Optional. Matches all Kubernetes service accounts in the provided namespace, unless a more specific `kubernetes_service_account` scope already matched.
"kubernetesServiceAccount": "A String", # Optional. Matches a single Kubernetes service account, e.g. `my-namespace:my-service-account`. `kubernetes_service_account` scope is always more specific than `kubernetes_namespace` scope for the same namespace.
},
},
"explanation": "A String", # Explanation of this image result. Only populated if no check sets were evaluated.
"imageUri": "A String", # Image URI from the request.
"verdict": "A String", # The result of evaluating this image.
},
],
"kubernetesNamespace": "A String", # The Kubernetes namespace of the Pod.
"kubernetesServiceAccount": "A String", # The Kubernetes service account of the Pod.
"podName": "A String", # The name of the Pod.
"verdict": "A String", # The result of evaluating this Pod.
},
],
"verdict": "A String", # The result of evaluating all Pods in the request.
}