Querying a Cluster Component Protection Policy Template

Function

This API is used to query a cluster protection policy template.

Authorization Information

Each account has all the permissions required to call all APIs, but IAM users must be assigned the required permissions.

• If you are using role/policy-based authorization, see Permissions Policies and Supported Actions for details on the required permissions.
• If you are using identity policy-based authorization, no identity policy-based permission required for calling this API.

URI

GET /v5/{project_id}/container/clusters/protection-policy-templates/{policy_template_id}

Request Parameters

Response Parameters

Status code: 200

Example Requests

None

Example Responses

Status code: 200

Request succeeded.

{
  "id" : "string",
  "template_name" : "string",
  "template_type" : "string",
  "description" : "string",
  "target_kind" : "Deployment;ReplicaSet;CronJob",
  "tag" : "string",
  "level" : "string",
  "constraint_template" : {
    "kind" : "ConstraintTemplate",
    "apiVersion" : "templates.gatekeeper.sh/v1",
    "metadata" : {
      "name" : "k8spspprocmount",
      "creationTimestamp" : null,
      "annotations" : {
        "description" : "Controls the allowed `procMount` types for the container. Corresponds to the `allowedProcMountTypes` field in a PodSecurityPolicy. For more information, see https://kubernetes.io/docs/concepts/policy/pod-security-policy/#allowedprocmounttypes",
        "description-chinese" : "Restrict the proc types that can be mounted to a pod.",
        "level" : "3",
        "metadata.gatekeeper.sh/title" : "Proc Mount",
        "metadata.gatekeeper.sh/version" : "1.0.0",
        "name-chinese" : "K8sPSPProcMount",
        "tag" : "Container/ApplicationSecurityPolicies",
        "tag-chinese" : "Container/Application security policy",
        "targetKind" : "Pod",
        "type" : "security"
      }
    },
    "spec" : {
      "crd" : {
        "spec" : {
          "names" : {
            "kind" : "K8sPSPProcMount"
          },
          "validation" : {
            "openAPIV3Schema" : {
              "description" : "Controls the allowed `procMount` types for the container. Corresponds to the `allowedProcMountTypes` field in a PodSecurityPolicy. For more information, see https://kubernetes.io/docs/concepts/policy/pod-security-policy/#allowedprocmounttypes",
              "type" : "object",
              "properties" : {
                "exemptImages" : {
                  "description" : "Any container that uses an image that matches an entry in this list will be excluded from enforcement. Prefix-matching can be signified with `*`. For example: `my-image-*`.\nIt is recommended that users use the fully-qualified Docker image name (e.g. start with a domain name) in order to avoid unexpectedly exempting images from an untrusted repository.",
                  "type" : "array",
                  "items" : {
                    "type" : "string"
                  }
                },
                "procMount" : {
                  "description" : "Defines the strategy for the security exposure of certain paths in `/proc` by the container runtime. Setting to `Default` uses the runtime defaults, where `Unmasked` bypasses the default behavior.",
                  "type" : "string",
                  "enum" : [ "Default", "Unmasked" ]
                }
              }
            }
          }
        }
      },
      "targets" : [ {
        "target" : "admission.k8s.gatekeeper.sh",
        "rego" : "package k8spspprocmount\nimport data.lib.exempt_container.is_exempt\nviolation[{\"msg\": msg, \"details\": {}}] {\n    c := input_containers[_]\n    not is_exempt(c)\n    allowedProcMount := get_allowed_proc_mount(input)\n    not input_proc_mount_type_allowed(allowedProcMount, c)\n    msg := sprintf(\"ProcMount type is not allowed, container: %v. Allowed procMount types: %v\", [c.name, allowedProcMount])\n}\ninput_proc_mount_type_allowed(allowedProcMount, c) {\n    allowedProcMount == \"default\"\n    lower(c.securityContext.procMount) == \"default\"\n}\ninput_proc_mount_type_allowed(allowedProcMount, c) {\n    allowedProcMount == \"unmasked\"\n}\ninput_containers[c] {\n    c := input.review.object.spec.containers[_]\n    c.securityContext.procMount\n}\ninput_containers[c] {\n    c := input.review.object.spec.initContainers[_]\n    c.securityContext.procMount\n}\ninput_containers[c] {\n    c := input.review.object.spec.ephemeralContainers[_]\n    c.securityContext.procMount\n}\nget_allowed_proc_mount(arg) = out {\n    not arg.parameters\n    out = \"default\"\n}\nget_allowed_proc_mount(arg) = out {\n    not arg.parameters.procMount\n    out = \"default\"\n}\nget_allowed_proc_mount(arg) = out {\n    not valid_proc_mount(arg.parameters.procMount)\n    out = \"default\"\n}\nget_allowed_proc_mount(arg) = out {\n    out = lower(arg.parameters.procMount)\n}\nvalid_proc_mount(str) {\n    lower(str) == \"default\"\n}\nvalid_proc_mount(str) {\n    lower(str) == \"unmasked\"\n}",
        "libs" : [ "package lib.exempt_container\nis_exempt(container) {\n    exempt_images := object.get(object.get(input, \"parameters\", {}), \"exemptImages\", [])\n    img := container.image\n    exemption := exempt_images[_]\n    _matches_exemption(img, exemption)\n}\n_matches_exemption(img, exemption) {\n    not endswith(exemption, \"*\")\n    exemption == img\n}\n_matches_exemption(img, exemption) {\n    endswith(exemption, \"*\")\n    prefix := trim_suffix(exemption, \"*\")\n    startswith(img, prefix)\n}" ]
      } ]
    },
    "status" : { }
  }
}

Status Codes

Error Codes

See Error Codes.