查询集群组件防护策略模板列表 - ListClusterProtectPolicyTemplates

功能介绍

查询集群防护策略模板列表。

调用方法

请参见如何调用API。

授权信息

账号具备所有API的调用权限，如果使用账号下的IAM用户调用当前API，该IAM用户需具备调用API所需的权限。

• 如果使用角色与策略授权，具体权限要求请参见权限和授权项。
• 如果使用身份策略授权，当前API调用无需身份策略权限。

URI

GET /v5/{project_id}/container/clusters/protection-policy-templates

请求参数

响应参数

状态码：200

请求示例

无

响应示例

状态码：200

请求已成功

{
  "total_num" : 10,
  "data_list" : [ {
    "id" : "string",
    "template_name" : "string",
    "template_type" : "string",
    "description" : "string",
    "target_kind" : "Deployment;ReplicaSet;CronJob",
    "tag" : "string",
    "level" : "string",
    "constraint_template" : {
      "kind" : "ConstraintTemplate",
      "apiVersion" : "templates.gatekeeper.sh/v1",
      "metadata" : {
        "name" : "k8spspprocmount",
        "creationTimestamp" : null,
        "annotations" : {
          "description" : "Controls the allowed `procMount` types for the container. Corresponds to the `allowedProcMountTypes` field in a PodSecurityPolicy. For more information, see https://kubernetes.io/docs/concepts/policy/pod-security-policy/#allowedprocmounttypes",
          "description-chinese" : "限制Pod允许挂载的Proc类型",
          "level" : "3",
          "metadata.gatekeeper.sh/title" : "Proc Mount",
          "metadata.gatekeeper.sh/version" : "1.0.0",
          "name-chinese" : "K8sPSPProcMount",
          "tag" : "Container/ApplicationSecurityPolicies",
          "tag-chinese" : "容器/应用安全策略",
          "targetKind" : "Pod",
          "type" : "security"
        }
      },
      "spec" : {
        "crd" : {
          "spec" : {
            "names" : {
              "kind" : "K8sPSPProcMount"
            },
            "validation" : {
              "openAPIV3Schema" : {
                "description" : "Controls the allowed `procMount` types for the container. Corresponds to the `allowedProcMountTypes` field in a PodSecurityPolicy. For more information, see https://kubernetes.io/docs/concepts/policy/pod-security-policy/#allowedprocmounttypes",
                "type" : "object",
                "properties" : {
                  "exemptImages" : {
                    "description" : "Any container that uses an image that matches an entry in this list will be excluded from enforcement. Prefix-matching can be signified with `*`. For example: `my-image-*`.\nIt is recommended that users use the fully-qualified Docker image name (e.g. start with a domain name) in order to avoid unexpectedly exempting images from an untrusted repository.",
                    "type" : "array",
                    "items" : {
                      "type" : "string"
                    }
                  },
                  "procMount" : {
                    "description" : "Defines the strategy for the security exposure of certain paths in `/proc` by the container runtime. Setting to `Default` uses the runtime defaults, where `Unmasked` bypasses the default behavior.",
                    "type" : "string",
                    "enum" : [ "Default", "Unmasked" ]
                  }
                }
              }
            }
          }
        },
        "targets" : [ {
          "target" : "admission.k8s.gatekeeper.sh",
          "rego" : "package k8spspprocmount\nimport data.lib.exempt_container.is_exempt\nviolation[{\"msg\": msg, \"details\": {}}] {\n    c := input_containers[_]\n    not is_exempt(c)\n    allowedProcMount := get_allowed_proc_mount(input)\n    not input_proc_mount_type_allowed(allowedProcMount, c)\n    msg := sprintf(\"ProcMount type is not allowed, container: %v. Allowed procMount types: %v\", [c.name, allowedProcMount])\n}\ninput_proc_mount_type_allowed(allowedProcMount, c) {\n    allowedProcMount == \"default\"\n    lower(c.securityContext.procMount) == \"default\"\n}\ninput_proc_mount_type_allowed(allowedProcMount, c) {\n    allowedProcMount == \"unmasked\"\n}\ninput_containers[c] {\n    c := input.review.object.spec.containers[_]\n    c.securityContext.procMount\n}\ninput_containers[c] {\n    c := input.review.object.spec.initContainers[_]\n    c.securityContext.procMount\n}\ninput_containers[c] {\n    c := input.review.object.spec.ephemeralContainers[_]\n    c.securityContext.procMount\n}\nget_allowed_proc_mount(arg) = out {\n    not arg.parameters\n    out = \"default\"\n}\nget_allowed_proc_mount(arg) = out {\n    not arg.parameters.procMount\n    out = \"default\"\n}\nget_allowed_proc_mount(arg) = out {\n    not valid_proc_mount(arg.parameters.procMount)\n    out = \"default\"\n}\nget_allowed_proc_mount(arg) = out {\n    out = lower(arg.parameters.procMount)\n}\nvalid_proc_mount(str) {\n    lower(str) == \"default\"\n}\nvalid_proc_mount(str) {\n    lower(str) == \"unmasked\"\n}",
          "libs" : [ "package lib.exempt_container\nis_exempt(container) {\n    exempt_images := object.get(object.get(input, \"parameters\", {}), \"exemptImages\", [])\n    img := container.image\n    exemption := exempt_images[_]\n    _matches_exemption(img, exemption)\n}\n_matches_exemption(img, exemption) {\n    not endswith(exemption, \"*\")\n    exemption == img\n}\n_matches_exemption(img, exemption) {\n    endswith(exemption, \"*\")\n    prefix := trim_suffix(exemption, \"*\")\n    startswith(img, prefix)\n}" ]
        } ]
      },
      "status" : { }
    }
  } ]
}

SDK代码示例

SDK代码示例如下。

状态码

错误码

请参见错误码。